Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
jk98mGM6JH.exe

Overview

General Information

Sample name:jk98mGM6JH.exe
renamed because original name is a hash value
Original sample name:736549a437da8dacb4c1d31c33ba75b8.exe
Analysis ID:1393148
MD5:736549a437da8dacb4c1d31c33ba75b8
SHA1:7eb5e89620f4a6de369a9667133cb2ef01d27ed3
SHA256:6fc1848ea0691845f977875ff74a353cbae23c75011c427720ec37659784860f
Tags:32exe
Infos:

Detection

RisePro Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Yara detected RisePro Stealer
Adds extensions / path to Windows Defender exclusion list (Registry)
Binary is likely a compiled AutoIt script file
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Disables Windows Defender Tamper protection
Exclude list of file types from scheduled, custom, and real-time scanning
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies Group Policy settings
Modifies windows update settings
PE file contains section with special chars
PE file has nameless sections
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found iframes
Found potential string decryption / allocating functions
HTML body contains low number of good links
HTML body contains password input but no form action
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Windows Defender Exclusions Added - Registry
Sleep loop found (likely to delay execution)
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • jk98mGM6JH.exe (PID: 1832 cmdline: C:\Users\user\Desktop\jk98mGM6JH.exe MD5: 736549A437DA8DACB4C1D31C33BA75B8)
    • schtasks.exe (PID: 1476 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 2012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 6484 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • PLO4plFr34jobsiEh08j.exe (PID: 1612 cmdline: "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe" MD5: 791ED44F9B3836A68F79B028EF7C49CB)
      • chrome.exe (PID: 424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/ MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
        • chrome.exe (PID: 7796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1960,i,11993553605994081514,18162534353999161792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 3280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
        • chrome.exe (PID: 7556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=1972,i,16301593684436752617,2012107364916416146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 7240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
        • chrome.exe (PID: 7284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,17726353602255924015,12176223097910466274,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 8044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/ MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
        • chrome.exe (PID: 8576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,8973374208484498469,2501955192980366572,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • msedge.exe (PID: 8780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com MD5: BF154738460E4AB1D388970E1AB13FAB)
        • msedge.exe (PID: 9416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2092,i,17673521410042216198,2537652209419044310,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)
      • msedge.exe (PID: 8808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video MD5: BF154738460E4AB1D388970E1AB13FAB)
        • msedge.exe (PID: 9740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,12923574770636312838,3728738922740556079,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)
      • msedge.exe (PID: 9060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com MD5: BF154738460E4AB1D388970E1AB13FAB)
        • msedge.exe (PID: 9984 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2160,i,17832719417900444124,13861847247960682782,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)
      • chrome.exe (PID: 9136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 8368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 9280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • firefox.exe (PID: 9576 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 9844 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 10112 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • zqdrYwv5fC6zkQ9Tresm.exe (PID: 8588 cmdline: "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe" MD5: 1C8A50F3E51F6AE258F38752193B1448)
    • Cr6QVRpzwqhYjtnCxFSW.exe (PID: 10132 cmdline: "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe" MD5: 880AA312796089DC66459C024727D591)
  • MPGPH131.exe (PID: 5048 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 736549A437DA8DACB4C1D31C33BA75B8)
  • MPGPH131.exe (PID: 2328 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 736549A437DA8DACB4C1D31C33BA75B8)
  • RageMP131.exe (PID: 3968 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 736549A437DA8DACB4C1D31C33BA75B8)
  • RageMP131.exe (PID: 9716 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 736549A437DA8DACB4C1D31C33BA75B8)
  • msedge.exe (PID: 9776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com MD5: BF154738460E4AB1D388970E1AB13FAB)
    • msedge.exe (PID: 7344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2940 --field-trial-handle=2724,i,4482519872048150816,8688360613915830786,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)
  • firefox.exe (PID: 10152 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 3504 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7360 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2188 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07a9cf11-a11c-4267-8dc4-740bf294e4fb} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d8896bf10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8756 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3432 -prefsLen 21837 -prefMapSize 238690 -jsInitHandle 1240 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b753b1f8-541a-487d-8ec8-3be5703ede91} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d99d93310 tab MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 7628 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 1908 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 10488 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 10956 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\2DNcPleZ9unxLWQic11TF6k.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
      0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
        00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
          00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
            00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
              Click to see the 11 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: CurrentVersion Autorun Keys Modification
              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\jk98mGM6JH.exe, ProcessId: 1832, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131
              Sigma detected: Windows Defender Exclusions Added - Registry
              Source: Registry Key setAuthor: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\jk98mGM6JH.exe, ProcessId: 1832, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for URL or domain
              Source: http://185.215.113.46/cost/fu.exe22jBF8Avira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/fu.exegertaAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/well.exeAppDataAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/fu.exekAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/well.exeAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/fu.exeAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/fu.exenAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/mine/plaza.exetAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/well.exenBuil6NAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/mine/plaza.exeAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/niks.exedAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/ladas.exelAvira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/well.exe6Avira URL Cloud: Label: malware
              Source: http://185.215.113.46/cost/fu.exegertaAAvira URL Cloud: Label: malware
              Multi AV Scanner detection for dropped file
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeReversingLabs: Detection: 42%
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeReversingLabs: Detection: 42%
              Machine Learning detection for dropped file
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeJoe Sandbox ML: detected
              Machine Learning detection for sample
              Source: jk98mGM6JH.exeJoe Sandbox ML: detected
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0062FF60 CryptUnprotectData,CryptUnprotectData,0_2_0062FF60
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0062FE80 CryptUnprotectData,CryptUnprotectData,0_2_0062FE80
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003AFF60 CryptUnprotectData,CryptUnprotectData,10_2_003AFF60
              Source: https://www.linkedin.com/loginHTTP Parser: Iframe src: https://accounts.google.com/gsi/button?logo_alignment=center&shape=pill&size=large&text=continue_with&theme=undefined&type=undefined&width=302&client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&iframe_id=gsi_757710_990935&as=X1V1e0xZ1dm4f1OCWbpjLA&hl=en_US
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1812329813&timestamp=1708035730584
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: Iframe src: /_/bscframe
              Source: https://accounts.google.com/gsi/button?logo_alignment=center&shape=pill&size=large&text=continue_with&theme=undefined&type=undefined&width=302&client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&iframe_id=gsi_757710_990935&as=X1V1e0xZ1dm4f1OCWbpjLA&hl=en_USHTTP Parser: Number of links: 0
              Source: https://www.linkedin.com/loginHTTP Parser: <input type="password" .../> found but no <form action="...
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: <input type="password" .../> found but no <form action="...
              Source: https://www.linkedin.com/loginHTTP Parser: <input type="password" .../> found
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: <input type="password" .../> found
              Source: https://www.facebook.com/videoHTTP Parser: <input type="password" .../> found
              Source: https://accounts.google.com/gsi/button?logo_alignment=center&shape=pill&size=large&text=continue_with&theme=undefined&type=undefined&width=302&client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&iframe_id=gsi_757710_990935&as=X1V1e0xZ1dm4f1OCWbpjLA&hl=en_USHTTP Parser: No favicon
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: No favicon
              Source: https://www.linkedin.com/loginHTTP Parser: No <meta name="author".. found
              Source: https://accounts.google.com/gsi/button?logo_alignment=center&shape=pill&size=large&text=continue_with&theme=undefined&type=undefined&width=302&client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&iframe_id=gsi_757710_990935&as=X1V1e0xZ1dm4f1OCWbpjLA&hl=en_USHTTP Parser: No <meta name="author".. found
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: No <meta name="author".. found
              Source: https://www.facebook.com/videoHTTP Parser: No <meta name="author".. found
              Source: https://www.facebook.com/videoHTTP Parser: No <meta name="author".. found
              Source: https://www.linkedin.com/loginHTTP Parser: No <meta name="copyright".. found
              Source: https://accounts.google.com/gsi/button?logo_alignment=center&shape=pill&size=large&text=continue_with&theme=undefined&type=undefined&width=302&client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&iframe_id=gsi_757710_990935&as=X1V1e0xZ1dm4f1OCWbpjLA&hl=en_USHTTP Parser: No <meta name="copyright".. found
              Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjxasiJo00Qiy392-82an10TMIjH5EeE5TP4s04Hw8EX8I8GqTWxbza_RYxlKB5u9-OC0tOEPg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S101607509%3A1708035626335480&theme=glifHTTP Parser: No <meta name="copyright".. found
              Source: https://www.facebook.com/videoHTTP Parser: No <meta name="copyright".. found
              Source: https://www.facebook.com/videoHTTP Parser: No <meta name="copyright".. found
              Source: jk98mGM6JH.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: Binary string: E:\offDef\offDef\offDef\obj\Release\offDef.pdb source: zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000003.2376524029.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000002.2644817789.0000000000182000.00000040.00000001.01000000.0000000B.sdmp

              Change of critical system settings

              barindex
              Adds extensions / path to Windows Defender exclusion list (Registry)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_ExtensionsJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exeJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_ExtensionsJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exeJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_ExtensionsJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exeJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0061C000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,0_2_0061C000
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006EB3B5 recv,FindFirstFileExW,0_2_006EB3B5
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039C000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,10_2_0039C000
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0046B3B5 recv,FindFirstFileExW,10_2_0046B3B5
              Source: firefox.exeMemory has grown: Private usage: 1MB later: 238MB
              Source: Joe Sandbox ViewIP Address: 13.107.6.158 13.107.6.158
              Source: Joe Sandbox ViewIP Address: 185.215.113.46 185.215.113.46
              Source: Joe Sandbox ViewIP Address: 185.215.113.46 185.215.113.46
              Source: Joe Sandbox ViewIP Address: 34.117.237.239 34.117.237.239
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0062DB60 recv,WSAStartup,closesocket,socket,connect,closesocket,0_2_0062DB60
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.comoL equals www.youtube.com (Youtube)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2479302326.0000019401710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video equals www.facebook.com (Facebook)
              Source: firefox.exe, 00000025.00000002.2479302326.0000019401710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/videoa equals www.facebook.com (Facebook)
              Source: firefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3103140639.0000000005D0F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: .www.linkedin.com equals www.linkedin.com (Linkedin)
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: .www.linkedin.comDesktop/`17 equals www.linkedin.com (Linkedin)
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: .www.linkedin.comDesktops/ equals www.linkedin.com (Linkedin)
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: .www.linkedin.comon.txt equals www.linkedin.com (Linkedin)
              Source: firefox.exe, 00000021.00000003.2348096158.000001716F3AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 2:o0`0https://www.youtube.com --attempting-deelevationUser equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000025.00000003.2385982807.000001940172C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.2386246776.0000019401742000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2479716309.0000019401743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 7n7https://www.facebook.com/video --attempting-deelevationUser equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2570259682.0000025D9D760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2857902611.0000025DA1285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2570259682.0000025D9D760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CBE4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2889197168.0000025D9CB20000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: </script><link rel="preload" href="https://i.ytimg.com/generate_204" as="fetch"><link as="script" rel="preload" href="https://www.youtube.com/s/desktop/bdb59273/jsbin/desktop_polymer.vflset/desktop_polymer.js" nonce="c40KzathyqN9OZzSpiA7sA"><script src="https://www.youtube.com/s/desktop/bdb59273/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js" nonce="c40KzathyqN9OZzSpiA7sA"></script><script src="https://www.youtube.com/s/desktop/bdb59273/jsbin/custom-elements-es5-adapter.vflset/c equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 00000009.00000003.2566880571.0000000005C0A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D15000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: =https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000025.00000002.2479302326.0000019401710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.facebook.com/video' equals www.facebook.com (Facebook)
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com--attempting-deelevation equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000025.00000002.2479302326.0000019401710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/videoC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default% equals www.facebook.com (Facebook)
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.comC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default+L equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2565805210.0000025DA2A50000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3103140639.0000000005D0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3118921927.0000000007022000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOCK equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3118921927.0000000007022000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOCKFt,) equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3118921927.0000000007022000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001 equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-0000011> equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3103140639.0000000005D0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3103140639.0000000005D0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log9z equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3103140639.0000000005D0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.logghn){0 equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3102589706.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3120396330.00000000071C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOCK equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3102589706.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3120396330.00000000071C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001 equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001Set: equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Device\HarddiskVolume3\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001Si equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facebook.com/https://www.facebook.com/videofacebook.com/videoA equals www.facebook.com (Facebook)
              Source: MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facebook.com/https://www.facebook.com/videofacebook.com/videoB equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.3013298836.0000025DA333D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C496000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2570259682.0000025D9D760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: MPGPH131.exe, 00000009.00000003.2566880571.0000000005C0A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/video equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/video( equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/video3 equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/videoG equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/videoU equals www.facebook.com (Facebook)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/videob equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/videoy equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/login equals www.linkedin.com (Linkedin)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/login[p equals www.linkedin.com (Linkedin)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/login_s equals www.linkedin.com (Linkedin)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DF2000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com! equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2877679617.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2877679617.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
              Source: firefox.exe, 0000002A.00000003.2877679617.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/Q equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/d equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ei":{"c: equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/l8uJgji equals www.youtube.com (Youtube)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/y equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/https://www.youtube.com/youtube.com equals www.youtube.com (Youtube)
              Source: MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/https://www.youtube.com/youtube.comQ equals www.youtube.com (Youtube)
              Source: firefox.exe, 00000025.00000003.2385982807.000001940172C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2479302326.000001940173A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.2409319591.0000019401739000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.facebook.com/video --attempting-deelevation equals www.facebook.com (Facebook)
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.youtube.com --attempting-deelevation equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: tlsflags0x00000000:www.facebook.com:443^partitionKey=%28https%2Cfacebook.com%29 equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: vs://www.facebook.com/video equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3015579017.0000025DA2F90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.facebook.com"P# equals www.facebook.com (Facebook)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.linkedin.comZPk equals www.linkedin.com (Linkedin)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.linkedin.comdPa equals www.linkedin.com (Linkedin)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2559294871.0000025D9D690000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.youtube.comv equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2565805210.0000025DA2A50000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
              Source: firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xtlsflags0x00000000:www.facebook.com:443^partitionKey=%28https%2Cfacebook.com%29 equals www.facebook.com (Facebook)
              Source: firefox.exe, 0000002A.00000003.2855426882.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://13.46/cexe
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2761057014.000000000605F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe
              Source: MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe(L
              Source: RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe22jBF8
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exegerta
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exegertaA
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exek
              Source: jk98mGM6JH.exe, 00000000.00000002.2761057014.000000000605F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exen
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exel
              Source: MPGPH131.exe, 00000009.00000003.2605609465.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3121450909.00000000072D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exe
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exeBuild:
              Source: MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exeJm(J
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exed
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exe
              Source: jk98mGM6JH.exe, 00000000.00000002.2761057014.00000000060A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exe6
              Source: jk98mGM6JH.exe, 00000000.00000002.2761057014.0000000006083000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exeAppData
              Source: MPGPH131.exe, 0000000A.00000002.3121450909.00000000072D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exeX
              Source: MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exeb
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exee
              Source: jk98mGM6JH.exe, 00000000.00000002.2761057014.00000000060A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exeles
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exenBuil6N
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2761057014.0000000006083000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3121450909.00000000072D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3120713333.000000000724C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe
              Source: MPGPH131.exe, 0000000A.00000002.3120713333.000000000724C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeRecorded
              Source: MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exet
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2876283032.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2889982783.0000025D9B7DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2876283032.0000025DA741D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
              Source: firefox.exe, 0000002A.00000003.2567909028.0000025DA1292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2846296858.0000025DA6B72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2857902611.0000025DA1285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3007802806.0000025DA6B72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868336724.0000025D9D769000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
              Source: firefox.exe, 0000002A.00000003.2868065030.0000025D9D792000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
              Source: firefox.exe, 0000002A.00000003.2868065030.0000025D9D792000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2888666753.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
              Source: zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000002.2669069049.00000000013A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.mic
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-04/schema#
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-06/schema#
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-07/schema#-
              Source: firefox.exe, 0000002A.00000003.2838482055.0000025DA704D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.o
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org
              Source: firefox.exe, 0000002A.00000003.2997069473.0000025D9B62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2969955150.0000025DA706D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2838482055.0000025DA7071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/
              Source: firefox.exe, 0000002A.00000003.2567909028.0000025DA1292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3001881155.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2785555547.0000025D9827F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2982409537.0000025D98396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2877038248.0000025D99B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2851446275.0000025DA3327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004996804.0000025DA7348000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2789678989.0000025D98B45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2790125806.0000025D98BF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2805681316.0000025D9889F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2836960295.0000025D983CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2616425023.0000025D988AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2784587168.0000025D98B34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2684449918.0000025D98282000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2805681316.0000025D988B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2755939146.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2823879379.0000025D988B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2955573200.0000025D98BE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2857902611.0000025DA1285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2620749654.0000025DA117D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2670258020.0000025D9492F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: firefox.exe, 0000002A.00000003.2877679617.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3008882516.0000025DA5FB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gsr10)
              Source: firefox.exe, 0000002A.00000003.2857902611.0000025DA1285000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gts1c3
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2876283032.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2889982783.0000025D9B7DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2876283032.0000025DA741D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gts1c301
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gtsr100
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000014A1000.00000040.00000001.01000000.0000000D.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000000.2348106157.0000000001743000.00000080.00000001.01000000.0000000D.sdmpString found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000014A1000.00000040.00000001.01000000.0000000D.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000000.2348106157.0000000001743000.00000080.00000001.01000000.0000000D.sdmpString found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000014A1000.00000040.00000001.01000000.0000000D.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000000.2348106157.0000000001743000.00000080.00000001.01000000.0000000D.sdmpString found in binary or memory: http://pki-ocsp.symauth.com0
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2876283032.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2889982783.0000025D9B7DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2876283032.0000025DA741D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
              Source: firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0.
              Source: firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org0
              Source: firefox.exe, 0000002A.00000003.2576185535.0000025D9AB6B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
              Source: jk98mGM6JH.exe, 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
              Source: firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
              Source: firefox.exe, 0000002A.00000003.2480242544.0000025D98800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185729135.0000000006063000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185578857.0000000006063000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
              Source: firefox.exe, 0000002A.00000003.2856989279.0000025DA12EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2889982783.0000025D9B7DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
              Source: firefox.exe, 0000002A.00000003.2864408444.0000025DA0F53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.firefox.comK
              Source: firefox.exe, 0000002A.00000003.2888666753.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
              Source: firefox.exe, 0000002A.00000003.2565805210.0000025DA2A32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2566693202.0000025DA286F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2792132402.0000025D995D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
              Source: firefox.exe, 0000002A.00000003.2868987909.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ATuJsjxfLX6W
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/3
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/C
              Source: firefox.exe, 0000002A.00000003.2880089736.0000025DA284E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://
              Source: MPGPH131.exe, 0000000A.00000002.3120615821.0000000007226000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3000180526.0000025DA7482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2867490495.0000025D9D898000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2874737929.0000025D9C496000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2867490495.0000025D9D8BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2889197168.0000025D9CB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2880089736.0000025DA284E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Yoc
              Source: firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/moc.elgoog.stnuocca.
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/pp
              Source: firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2880089736.0000025DA284E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&follo
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com1
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comB
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3529684760.0000000000990000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2443870042.0000020FCB850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comC:
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comP
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comQ
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comeo
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comeo6
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comi
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comx
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comxv
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comy
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
              Source: firefox.exe, 0000002A.00000003.2755939146.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2670258020.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2781409848.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2824718699.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2701524214.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2808635227.0000025D9492F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185729135.0000000006063000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185578857.0000000006063000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185729135.0000000006063000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185578857.0000000006063000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185729135.0000000006063000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185578857.0000000006063000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
              Source: firefox.exe, 0000002A.00000003.2575885925.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
              Source: firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net
              Source: firefox.exe, 0000002A.00000003.2854870315.0000025DA2F7A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
              Source: firefox.exe, 0000002A.00000003.2878280004.0000025DA2EB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
              Source: firefox.exe, 0000002A.00000003.3004996804.0000025DA7362000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/gse_qebhlk
              Source: firefox.exe, 0000002A.00000003.2668225406.0000025D95BC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2951582876.0000025D95B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
              Source: firefox.exe, 0000002A.00000003.2570259682.0000025D9D760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2961467272.0000025DA1156000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
              Source: firefox.exe, 0000002A.00000003.2677411475.0000025D99913000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/Z
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
              Source: firefox.exe, 0000002A.00000003.2554771171.0000025DA30E5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/y
              Source: firefox.exe, 0000002A.00000003.2564308495.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2856459014.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2878599347.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
              Source: firefox.exe, 0000002A.00000003.2815986209.0000025D99B9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2814873762.0000025D99B48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2557310441.0000025DA70E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
              Source: firefox.exe, 0000002A.00000003.2815986209.0000025D99B9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2814873762.0000025D99B48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2557310441.0000025DA70E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
              Source: firefox.exe, 0000002A.00000003.2856989279.0000025DA12EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2856459014.0000025DA2D4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2878599347.0000025DA2D50000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com
              Source: firefox.exe, 0000002A.00000003.2888666753.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
              Source: firefox.exe, 0000002A.00000003.3004996804.0000025DA7362000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
              Source: firefox.exe, 0000002A.00000003.2564308495.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2856459014.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2878599347.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
              Source: firefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
              Source: firefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
              Source: firefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendationsS
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendationsS7
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
              Source: firefox.exe, 0000002A.00000003.2620749654.0000025DA117D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2591997474.0000025DA116F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
              Source: firefox.exe, 0000002A.00000003.2620749654.0000025DA117D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2591997474.0000025DA116F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
              Source: firefox.exe, 0000002A.00000003.2480242544.0000025D98800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
              Source: firefox.exe, 0000002A.00000003.2805681316.0000025D988DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F38000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/zertosh/loose-envify)
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
              Source: firefox.exe, 0000002A.00000003.2880089736.0000025DA284E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
              Source: firefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://i.ytimg.com/generate_204
              Source: firefox.exe, 0000002A.00000003.2805681316.0000025D988B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2808309150.0000025D988B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ib.absa.co.za/
              Source: firefox.exe, 0000002A.00000003.2865926671.0000025D9DB5C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
              Source: firefox.exe, 0000002A.00000003.2865926671.0000025D9DB5C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/cmd/H
              Source: firefox.exe, 0000002A.00000003.2865926671.0000025D9DB5C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/cmd/HCX
              Source: firefox.exe, 0000002A.00000003.2865926671.0000025D9DB5C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
              Source: firefox.exe, 0000002A.00000003.2865926671.0000025D9DB5C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
              Source: firefox.exe, 0000002A.00000003.3011163448.0000025DA336F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
              Source: firefox.exe, 0000002A.00000003.2856459014.0000025DA2D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2564308495.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit
              Source: firefox.exe, 0000002A.00000003.3000180526.0000025DA7482000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/9a79d70f-85b2-4e0d-986e-5df43
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submits
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000767000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000773000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000773000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/Mozilla/5.0
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/h
              Source: jk98mGM6JH.exe, 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/o?iz
              Source: RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/t8h
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222A
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000773000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222D
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222I$
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.000000000105E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000773000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.227.222
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.227.222lp
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema.
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema./
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2020-12/schema/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
              Source: firefox.exe, 0000002A.00000003.2889197168.0000025D9CB20000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/
              Source: firefox.exe, 0000002A.00000003.2889982783.0000025D9B7DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
              Source: firefox.exe, 0000002A.00000003.2844586974.0000025DA6B7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com
              Source: firefox.exe, 0000002A.00000003.2868065030.0000025D9D7D3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
              Source: firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pki.goog/repository/0
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F38000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
              Source: firefox.exe, 0000002A.00000003.2855426882.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D449000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868987909.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
              Source: firefox.exe, 0000002A.00000003.2855426882.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
              Source: firefox.exe, 0000002A.00000003.2855426882.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
              Source: firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
              Source: firefox.exe, 0000002A.00000003.2668225406.0000025D95BC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2951582876.0000025D95B83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
              Source: firefox.exe, 0000002A.00000003.2878280004.0000025DA2EB8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
              Source: firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA12C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2857534525.0000025DA12D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com
              Source: firefox.exe, 0000002A.00000003.2564308495.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2856459014.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2878599347.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#l
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864408444.0000025DA0F53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/user
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com
              Source: firefox.exe, 0000002A.00000003.2846608781.0000025DA5F68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2877679617.0000025DA5F6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868987909.0000025D9D449000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3008882516.0000025DA5F6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3015579017.0000025DA2F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2854870315.0000025DA2F7A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
              Source: firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
              Source: firefox.exe, 0000002A.00000003.2873842339.0000025D9CAFD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
              Source: firefox.exe, 0000002A.00000003.2565805210.0000025DA2AA3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT2
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000071E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTMI
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.00000000007C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot&
              Source: MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot:d1
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botW
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botuZ
              Source: RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/riseprom
              Source: firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
              Source: firefox.exe, 0000002A.00000003.2864530719.0000025DA0F38000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://webpack.js.org/concepts/mode/)
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
              Source: firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
              Source: firefox.exe, 0000002A.00000003.2480242544.0000025D98800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2857684648.0000025DA12A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2961467272.0000025DA1156000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2489554800.0000025D94EBD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
              Source: firefox.exe, 0000002A.00000003.2575167409.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185729135.0000000006063000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185578857.0000000006063000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com;report-uri
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
              Source: firefox.exe, 0000002A.00000003.2533774985.0000025DA11BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2540341700.0000025DA11DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search
              Source: firefox.exe, 0000002A.00000003.2480242544.0000025D98800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
              Source: jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
              Source: firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2961467272.0000025DA1156000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2489554800.0000025D94EBD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
              Source: firefox.exe, 0000002A.00000003.2789976360.0000025D98B7E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
              Source: firefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/login
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/login_s
              Source: firefox.exe, 0000002A.00000003.2883620557.0000025D9D453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2870621451.0000025D9D42F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
              Source: firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D447000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/
              Source: firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
              Source: firefox.exe, 0000002A.00000003.2815986209.0000025D99B9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2814873762.0000025D99B48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2557310441.0000025DA70E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
              Source: firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
              Source: firefox.exe, 0000002A.00000003.2565805210.0000025DA2AA3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
              Source: firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/V
              Source: firefox.exe, 0000002A.00000003.2874498443.0000025D9C4A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
              Source: firefox.exe, 0000002A.00000003.2575885925.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
              Source: firefox.exe, 0000002A.00000003.2838482055.0000025DA704D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.sling.com/
              Source: firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
              Source: firefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2559294871.0000025D9D690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2578860426.0000025D9D690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2625854245.0000025D9D690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2671231461.0000025D9D682000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2676333857.0000025D9D69E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2662734500.0000025D9D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com
              Source: firefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com--attempting-deelevation
              Source: firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2806719806.0000025D995D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/Q
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/d
              Source: MPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ei
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/l8uJgji
              Source: firefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/desktop/bdb59273/jsbin/custom-elements-es5-adapter.vflset/c
              Source: firefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/desktop/bdb59273/jsbin/desktop_polymer.vflset/desktop_polymer.js
              Source: firefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/desktop/bdb59273/jsbin/web-animations-next-lite.min.vflset/web-animations-
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/y
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.comC:
              Source: firefox.exe, 00000021.00000002.2386659460.000001716F390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.comoL
              Source: MPGPH131.exe, 00000009.00000003.2566880571.0000000005C05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/https://www.youtube.com/youtube.com
              Source: MPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/https://www.youtube.com/youtube.comQ

              System Summary

              barindex
              Binary is likely a compiled AutoIt script file
              Source: jk98mGM6JH.exe, 00000000.00000003.2522548719.0000000006A2F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_b656faa8-2
              Source: jk98mGM6JH.exe, 00000000.00000003.2522548719.0000000006A2F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_4c03634b-e
              Source: MPGPH131.exe, 0000000A.00000003.2805785713.00000000084B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_fe3ed8d3-7
              Source: MPGPH131.exe, 0000000A.00000003.2805785713.00000000084B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_093bed90-7
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3533826611.0000000000CC2000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_a491f479-0
              Source: PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3533826611.0000000000CC2000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_b1f71927-3
              PE file contains section with special chars
              Source: jk98mGM6JH.exeStatic PE information: section name:
              Source: jk98mGM6JH.exeStatic PE information: section name: .idata
              Source: jk98mGM6JH.exeStatic PE information: section name:
              Source: RageMP131.exe.0.drStatic PE information: section name:
              Source: RageMP131.exe.0.drStatic PE information: section name: .idata
              Source: RageMP131.exe.0.drStatic PE information: section name:
              Source: MPGPH131.exe.0.drStatic PE information: section name:
              Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
              Source: MPGPH131.exe.0.drStatic PE information: section name:
              Source: ladas[1].exe.0.drStatic PE information: section name:
              Source: ladas[1].exe.0.drStatic PE information: section name: .idata
              Source: ladas[1].exe.0.drStatic PE information: section name:
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name:
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: .idata
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name:
              Source: niks[1].exe.0.drStatic PE information: section name:
              Source: niks[1].exe.0.drStatic PE information: section name: .idata
              Source: niks[1].exe.0.drStatic PE information: section name:
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name:
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name: .idata
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name:
              PE file has nameless sections
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039A400 RtlAllocateHeap,NtQuerySystemInformation,HeapFree,RtlFreeHeap,RtlAllocateHeap,NtQuerySystemInformation,HeapFree,10_2_0039A400
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039A720 NtDuplicateObject,CreateThread,RtlUnicodeStringToAnsiString,TerminateThread,10_2_0039A720
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Windows\SysWOW64\GroupPolicy\gpt.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006638500_2_00663850
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006408300_2_00640830
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0061F0000_2_0061F000
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006EA8000_2_006EA800
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0066D0C00_2_0066D0C0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006448800_2_00644880
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006521E00_2_006521E0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006651F00_2_006651F0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006682200_2_00668220
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00635A300_2_00635A30
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0063BA000_2_0063BA00
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006502F00_2_006502F0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006632900_2_00663290
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006213700_2_00621370
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0065DB000_2_0065DB00
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00648C200_2_00648C20
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006A44E00_2_006A44E0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006205300_2_00620530
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0064D5300_2_0064D530
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006465300_2_00646530
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006385100_2_00638510
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006475F00_2_006475F0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00657DC00_2_00657DC0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006F95DD0_2_006F95DD
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0063DE100_2_0063DE10
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006346D00_2_006346D0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0064A6900_2_0064A690
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00640F500_2_00640F50
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006307200_2_00630720
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0063A7000_2_0063A700
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00651FA00_2_00651FA0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006590400_2_00659040
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006120500_2_00612050
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006919400_2_00691940
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0062A1000_2_0062A100
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006F991F0_2_006F991F
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0070D1E10_2_0070D1E1
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006AD1A00_2_006AD1A0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006402600_2_00640260
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006A22500_2_006A2250
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006122C00_2_006122C0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0061AB500_2_0061AB50
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0069BBB00_2_0069BBB0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00694C200_2_00694C20
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0069D4200_2_0069D420
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0068F4100_2_0068F410
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0066A4800_2_0066A480
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0069DD600_2_0069DD60
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00690EC00_2_00690EC0
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006F3ED80_2_006F3ED8
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006F07500_2_006F0750
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0061A7200_2_0061A720
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006807900_2_00680790
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C083010_2_003C0830
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0046A80010_2_0046A800
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C488010_2_003C4880
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003B5A3010_2_003B5A30
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003BBA0010_2_003BBA00
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003E329010_2_003E3290
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003D02F010_2_003D02F0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003DDB0010_2_003DDB00
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039AB5010_2_0039AB50
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C8C2010_2_003C8C20
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_004244E010_2_004244E0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C653010_2_003C6530
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003B851010_2_003B8510
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C75F010_2_003C75F0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003BDE1010_2_003BDE10
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003CA69010_2_003CA690
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003B46D010_2_003B46D0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039A72010_2_0039A720
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003B072010_2_003B0720
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003BA70010_2_003BA700
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C0F5010_2_003C0F50
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039205010_2_00392050
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_004020B010_2_004020B0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0041194010_2_00411940
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003AA10010_2_003AA100
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0047991F10_2_0047991F
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0042D1A010_2_0042D1A0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0042225010_2_00422250
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003C026010_2_003C0260
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003922C010_2_003922C0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0041BBB010_2_0041BBB0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0040F41010_2_0040F410
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_00414C2010_2_00414C20
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0041D42010_2_0041D420
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0041DD6010_2_0041DD60
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_00410EC010_2_00410EC0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_00473ED810_2_00473ED8
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_004006F010_2_004006F0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0047075010_2_00470750
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: String function: 00679BB0 appears 37 times
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: String function: 003F9BB0 appears 32 times
              Source: ladas[1].exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: jk98mGM6JH.exe, 00000000.00000002.2722116251.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAy3Info.exe0 vs jk98mGM6JH.exe
              Source: jk98mGM6JH.exe, 00000000.00000003.2133045182.00000000053D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAy3Info.exe0 vs jk98mGM6JH.exe
              Source: jk98mGM6JH.exe, 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameAy3Info.exe0 vs jk98mGM6JH.exe
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: gpedit.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: activeds.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: dssec.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: dsuiext.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: framedynos.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: adsldpc.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: dsrole.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: authz.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ntdsapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: devobj.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: webio.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: schannel.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: vaultcli.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpedit.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: activeds.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dssec.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dsuiext.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: framedynos.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: authz.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: adsldpc.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dsrole.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mpr.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntdsapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpedit.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: activeds.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dssec.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dsuiext.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: framedynos.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: adsldpc.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: authz.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dsrole.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mpr.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntdsapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: profapi.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: propsys.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: edputil.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: slc.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: userenv.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sppc.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpedit.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: activeds.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dssec.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dsuiext.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: framedynos.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: adsldpc.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: authz.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dsrole.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: logoncli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mpr.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntdsapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: webio.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: schannel.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wsock32.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: winmm.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: mpr.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wininet.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: userenv.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: propsys.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: urlmon.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: iertutil.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: srvcli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: windows.shell.servicehostbuilder.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: onecoreuapcommonproxystub.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: ieframe.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: netapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wkscli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: windows.staterepositoryps.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: edputil.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: secur32.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: mlang.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: policymanager.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: msvcp110_win.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: onecorecommonproxystub.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: pcacli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: sfc_os.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: ieframe.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: netapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wkscli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: ieframe.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: netapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wkscli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: ieframe.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: netapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: wkscli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: appresolver.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: bcp47langs.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: slc.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeSection loaded: sppc.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: winmm.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: mscoree.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpedit.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: activeds.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dssec.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dsuiext.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: framedynos.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: adsldpc.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: authz.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dsrole.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: logoncli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mpr.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntdsapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: webio.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: schannel.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: shfolder.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: wininet.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: devobj.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: webio.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: schannel.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeSection loaded: kernel.appcore.dll
              Source: jk98mGM6JH.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: jk98mGM6JH.exeStatic PE information: Section: ZLIB complexity 0.9993478201486014
              Source: RageMP131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9993478201486014
              Source: MPGPH131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9993478201486014
              Source: ladas[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9999777275219298
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: Section: ZLIB complexity 0.9999777275219298
              Source: niks[1].exe.0.drStatic PE information: Section: cxfojuyk ZLIB complexity 0.9946840882266155
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: Section: cxfojuyk ZLIB complexity 0.9946840882266155
              Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.999699193329718
              Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9967268318965518
              Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9948046875
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: Section: ZLIB complexity 0.999699193329718
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: Section: ZLIB complexity 0.9967268318965518
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: Section: ZLIB complexity 0.9948046875
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@173/969@0/90
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039AB50 CreateToolhelp32Snapshot,10_2_0039AB50
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\RageMP131Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2012:120:WilError_03
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Temp\rage131MP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile read: C:\Windows\SysWOW64\GroupPolicy\gpt.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: firefox.exe, 0000002A.00000003.3004996804.0000025DA7348000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
              Source: jk98mGM6JH.exe, 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
              Source: jk98mGM6JH.exe, 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT sum(count) FROM events;9'
              Source: jk98mGM6JH.exe, 00000000.00000003.2181536400.0000000001145000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2181813757.000000000114D000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2181598278.000000000114B000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2192520723.0000000001143000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2192630785.0000000001145000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2181536400.0000000001149000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2509891919.0000000005C14000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2512884043.0000000005C24000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514881246.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2502164564.0000000000EE6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT sum(count) FROM events;9
              Source: firefox.exe, 0000002A.00000003.2882500850.0000025D9DB9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
              Source: jk98mGM6JH.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
              Source: MPGPH131.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile read: C:\Users\user\Desktop\jk98mGM6JH.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\jk98mGM6JH.exe C:\Users\user\Desktop\jk98mGM6JH.exe
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
              Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
              Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
              Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
              Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe"
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=1972,i,16301593684436752617,2012107364916416146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1960,i,11993553605994081514,18162534353999161792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,17726353602255924015,12176223097910466274,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,8973374208484498469,2501955192980366572,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe"
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2092,i,17673521410042216198,2537652209419044310,262144 /prefetch:3
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
              Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,12923574770636312838,3728738922740556079,262144 /prefetch:3
              Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2160,i,17832719417900444124,13861847247960682782,262144 /prefetch:3
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe"
              Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2940 --field-trial-handle=2724,i,4482519872048150816,8688360613915830786,262144 /prefetch:3
              Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
              Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2188 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07a9cf11-a11c-4267-8dc4-740bf294e4fb} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d8896bf10 socket
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3432 -prefsLen 21837 -prefMapSize 238690 -jsInitHandle 1240 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b753b1f8-541a-487d-8ec8-3be5703ede91} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d99d93310 tab
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHESTJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe" Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe" Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe" Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1960,i,11993553605994081514,18162534353999161792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=1972,i,16301593684436752617,2012107364916416146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,17726353602255924015,12176223097910466274,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,8973374208484498469,2501955192980366572,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2092,i,17673521410042216198,2537652209419044310,262144 /prefetch:3
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,12923574770636312838,3728738922740556079,262144 /prefetch:3
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2160,i,17832719417900444124,13861847247960682782,262144 /prefetch:3
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2940 --field-trial-handle=2724,i,4482519872048150816,8688360613915830786,262144 /prefetch:3
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2188 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07a9cf11-a11c-4267-8dc4-740bf294e4fb} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d8896bf10 socket
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3432 -prefsLen 21837 -prefMapSize 238690 -jsInitHandle 1240 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b753b1f8-541a-487d-8ec8-3be5703ede91} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d99d93310 tab
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
              Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile written: C:\Windows\SysWOW64\GroupPolicy\gpt.iniJump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: jk98mGM6JH.exeStatic file information: File size 2393600 > 1048576
              Source: jk98mGM6JH.exeStatic PE information: Raw size of idnrjgyt is bigger than: 0x100000 < 0x1b3a00
              Source: Binary string: E:\offDef\offDef\offDef\obj\Release\offDef.pdb source: zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000003.2376524029.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000002.2644817789.0000000000182000.00000040.00000001.01000000.0000000B.sdmp

              Data Obfuscation

              barindex
              Detected unpacking (changes PE section rights)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeUnpacked PE file: 0.2.jk98mGM6JH.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW;
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeUnpacked PE file: 10.2.MPGPH131.exe.390000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW;
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 13.2.RageMP131.exe.1000000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW;
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeUnpacked PE file: 25.2.zqdrYwv5fC6zkQ9Tresm.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cxfojuyk:EW;begfdfyp:EW; vs :ER;.rsrc:W;
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 34.2.RageMP131.exe.1000000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnrjgyt:EW;ssvxgfuk:EW;.taggant:EW;
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeUnpacked PE file: 40.2.Cr6QVRpzwqhYjtnCxFSW.exe.e50000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
              Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
              Source: jk98mGM6JH.exeStatic PE information: real checksum: 0x24efce should be: 0x250261
              Source: plaza[1].exe.0.drStatic PE information: real checksum: 0x0 should be: 0x2fc916
              Source: RageMP131.exe.0.drStatic PE information: real checksum: 0x24efce should be: 0x250261
              Source: MPGPH131.exe.0.drStatic PE information: real checksum: 0x24efce should be: 0x250261
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x2fc916
              Source: ladas[1].exe.0.drStatic PE information: real checksum: 0x23dd52 should be: 0x244852
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: real checksum: 0x23dd52 should be: 0x244852
              Source: jk98mGM6JH.exeStatic PE information: section name:
              Source: jk98mGM6JH.exeStatic PE information: section name: .idata
              Source: jk98mGM6JH.exeStatic PE information: section name:
              Source: jk98mGM6JH.exeStatic PE information: section name: idnrjgyt
              Source: jk98mGM6JH.exeStatic PE information: section name: ssvxgfuk
              Source: jk98mGM6JH.exeStatic PE information: section name: .taggant
              Source: RageMP131.exe.0.drStatic PE information: section name:
              Source: RageMP131.exe.0.drStatic PE information: section name: .idata
              Source: RageMP131.exe.0.drStatic PE information: section name:
              Source: RageMP131.exe.0.drStatic PE information: section name: idnrjgyt
              Source: RageMP131.exe.0.drStatic PE information: section name: ssvxgfuk
              Source: RageMP131.exe.0.drStatic PE information: section name: .taggant
              Source: MPGPH131.exe.0.drStatic PE information: section name:
              Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
              Source: MPGPH131.exe.0.drStatic PE information: section name:
              Source: MPGPH131.exe.0.drStatic PE information: section name: idnrjgyt
              Source: MPGPH131.exe.0.drStatic PE information: section name: ssvxgfuk
              Source: MPGPH131.exe.0.drStatic PE information: section name: .taggant
              Source: ladas[1].exe.0.drStatic PE information: section name:
              Source: ladas[1].exe.0.drStatic PE information: section name: .idata
              Source: ladas[1].exe.0.drStatic PE information: section name:
              Source: ladas[1].exe.0.drStatic PE information: section name: jyzrikla
              Source: ladas[1].exe.0.drStatic PE information: section name: swzyazqz
              Source: ladas[1].exe.0.drStatic PE information: section name: .taggant
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name:
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: .idata
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name:
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: jyzrikla
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: swzyazqz
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: .taggant
              Source: niks[1].exe.0.drStatic PE information: section name:
              Source: niks[1].exe.0.drStatic PE information: section name: .idata
              Source: niks[1].exe.0.drStatic PE information: section name:
              Source: niks[1].exe.0.drStatic PE information: section name: cxfojuyk
              Source: niks[1].exe.0.drStatic PE information: section name: begfdfyp
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name:
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name: .idata
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name:
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name: cxfojuyk
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name: begfdfyp
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: plaza[1].exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name:
              Source: gmpopenh264.dll.tmp.42.drStatic PE information: section name: .rodata
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006ED509 push ecx; ret 0_2_006ED51C
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0046D509 push ecx; ret 10_2_0046D51C
              Source: jk98mGM6JH.exeStatic PE information: section name: entropy: 7.988716513246667
              Source: jk98mGM6JH.exeStatic PE information: section name: idnrjgyt entropy: 7.913450001679227
              Source: RageMP131.exe.0.drStatic PE information: section name: entropy: 7.988716513246667
              Source: RageMP131.exe.0.drStatic PE information: section name: idnrjgyt entropy: 7.913450001679227
              Source: MPGPH131.exe.0.drStatic PE information: section name: entropy: 7.988716513246667
              Source: MPGPH131.exe.0.drStatic PE information: section name: idnrjgyt entropy: 7.913450001679227
              Source: ladas[1].exe.0.drStatic PE information: section name: entropy: 7.9864508087237045
              Source: ladas[1].exe.0.drStatic PE information: section name: jyzrikla entropy: 7.949980893603798
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: entropy: 7.9864508087237045
              Source: b2H5rX9tWHjbJEBjMEvH.exe.0.drStatic PE information: section name: jyzrikla entropy: 7.949980893603798
              Source: niks[1].exe.0.drStatic PE information: section name: entropy: 7.799137207263004
              Source: niks[1].exe.0.drStatic PE information: section name: cxfojuyk entropy: 7.953527916428882
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name: entropy: 7.799137207263004
              Source: zqdrYwv5fC6zkQ9Tresm.exe.0.drStatic PE information: section name: cxfojuyk entropy: 7.953527916428882
              Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.999500018313179
              Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.994897452545235
              Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.317247447961688
              Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.986028047520455
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name: entropy: 7.999500018313179
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name: entropy: 7.994897452545235
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name: entropy: 7.317247447961688
              Source: Cr6QVRpzwqhYjtnCxFSW.exe.0.drStatic PE information: section name: entropy: 7.986028047520455
              Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmpJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\niks[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\b2H5rX9tWHjbJEBjMEvH.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\61EWU8OcULp0D6CDdq0e.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\plaza[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\fu[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\well[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeJump to dropped file
              Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll (copy)Jump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ladas[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file

              Boot Survival

              barindex
              Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: FilemonClassJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: RegmonClassJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: FilemonClassJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: RegmonclassJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: FilemonclassJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonclassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonclassJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Filemonclass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: FilemonClass
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: RegmonClass
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: FilemonClass
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: Regmonclass
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: Filemonclass
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Filemonclass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
              Uses schtasks.exe or at.exe to add and modify task schedules
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Tries to detect sandboxes / dynamic malware analysis system (registry check)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeFile opened: HKEY_CURRENT_USER\Software\Wine
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
              Tries to detect virtualization through RDTSC time measurements
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008CF16A second address: 00000000008CF177 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008CF177 second address: 00000000008CF186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F41B1011B46h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D693F second address: 00000000008D6944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D6944 second address: 00000000008D694A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D694A second address: 00000000008D694E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D694E second address: 00000000008D6960 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F41B1011B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F41B1011B52h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D6C76 second address: 00000000008D6C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D7164 second address: 00000000008D7168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D7168 second address: 00000000008D71A3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F41B1244246h 0x00000008 jmp 00007F41B1244251h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007F41B1244246h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F41B1244254h 0x0000001f popad 0x00000020 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAC16 second address: 00000000008DAC43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007F41B1011B50h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F41B1011B4Fh 0x00000018 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAC43 second address: 000000000075DA86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b ja 00007F41B124424Eh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007F41B124424Ch 0x0000001a pop eax 0x0000001b jmp 00007F41B124424Ch 0x00000020 push dword ptr [ebp+122D1425h] 0x00000026 mov edi, dword ptr [ebp+122D2AEDh] 0x0000002c call dword ptr [ebp+122D265Dh] 0x00000032 pushad 0x00000033 mov dword ptr [ebp+122D3439h], ebx 0x00000039 xor eax, eax 0x0000003b jmp 00007F41B1244257h 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 jnc 00007F41B1244247h 0x0000004a mov dword ptr [ebp+122D2C65h], eax 0x00000050 mov dword ptr [ebp+122D2655h], eax 0x00000056 mov esi, 0000003Ch 0x0000005b jmp 00007F41B1244252h 0x00000060 mov dword ptr [ebp+122D2655h], ebx 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a or dword ptr [ebp+122D1AA6h], ecx 0x00000070 lodsw 0x00000072 mov dword ptr [ebp+122D3439h], ebx 0x00000078 sub dword ptr [ebp+122D1891h], edi 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 mov dword ptr [ebp+122D1891h], eax 0x00000088 mov ebx, dword ptr [esp+24h] 0x0000008c sub dword ptr [ebp+122D1AA6h], ecx 0x00000092 push eax 0x00000093 push ecx 0x00000094 push edx 0x00000095 push eax 0x00000096 push edx 0x00000097 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DACDF second address: 00000000008DAD07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ecx, dword ptr [ebp+122D1B64h] 0x00000010 push 00000000h 0x00000012 mov si, cx 0x00000015 push 3B409471h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jc 00007F41B1011B46h 0x00000023 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAD07 second address: 00000000008DAD62 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F41B1244256h 0x0000000b popad 0x0000000c xor dword ptr [esp], 3B4094F1h 0x00000013 mov dword ptr [ebp+122D1C14h], ecx 0x00000019 push 00000003h 0x0000001b push ebx 0x0000001c mov esi, dword ptr [ebp+122D2C31h] 0x00000022 pop edi 0x00000023 push 00000000h 0x00000025 mov edx, edi 0x00000027 push 00000003h 0x00000029 jmp 00007F41B1244254h 0x0000002e sbb ch, FFFFFFF0h 0x00000031 push 9837DAC7h 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a pop edi 0x0000003b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAD62 second address: 00000000008DAD66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAD66 second address: 00000000008DAD80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F41B1244252h 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAEAC second address: 00000000008DAEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jc 00007F41B1011B46h 0x0000000c jmp 00007F41B1011B4Bh 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push ebx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jp 00007F41B1011B46h 0x0000001e popad 0x0000001f pop ebx 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAEDE second address: 00000000008DAEE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAEE4 second address: 00000000008DAEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DAFE9 second address: 00000000008DB056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007F41B1244246h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 add dword ptr [esp], 31D5AB7Bh 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F41B1244248h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 sub ecx, dword ptr [ebp+122D17FBh] 0x0000003b push 00000003h 0x0000003d movsx edx, cx 0x00000040 push 00000000h 0x00000042 mov ecx, dword ptr [ebp+122D2D59h] 0x00000048 cmc 0x00000049 push 00000003h 0x0000004b or dword ptr [ebp+122D340Ch], esi 0x00000051 call 00007F41B1244249h 0x00000056 push ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DB056 second address: 00000000008DB05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DB05A second address: 00000000008DB081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007F41B1244252h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jo 00007F41B1244250h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DB081 second address: 00000000008DB0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jc 00007F41B1011B51h 0x0000000f jmp 00007F41B1011B4Bh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F41B1011B59h 0x00000020 jmp 00007F41B1011B53h 0x00000025 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008DB0BA second address: 00000000008DB0CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B124424Fh 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008FAA0A second address: 00000000008FAA0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008FAA0E second address: 00000000008FAA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008FAA14 second address: 00000000008FAA1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008FAA1C second address: 00000000008FAA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D0D86 second address: 00000000008D0D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D0D8B second address: 00000000008D0DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F41B1244254h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F41B1244253h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008D0DBD second address: 00000000008D0DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F8BE6 second address: 00000000008F8C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1244254h 0x00000009 jns 00007F41B1244246h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F41B1244257h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jl 00007F41B1244246h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F8C2C second address: 00000000008F8C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F8C30 second address: 00000000008F8C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9022 second address: 00000000008F9027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9027 second address: 00000000008F9037 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F41B1244246h 0x0000000a jc 00007F41B1244246h 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9193 second address: 00000000008F919F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F41B1011B46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F919F second address: 00000000008F91D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F41B1244258h 0x00000008 jmp 00007F41B1244254h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F91D0 second address: 00000000008F9212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F41B1011B51h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jc 00007F41B1011B4Ch 0x00000013 js 00007F41B1011B5Ah 0x00000019 jmp 00007F41B1011B54h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F936F second address: 00000000008F9373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9373 second address: 00000000008F938A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B53h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F938A second address: 00000000008F9396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9396 second address: 00000000008F939A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F939A second address: 00000000008F93CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F41B1244252h 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9547 second address: 00000000008F954B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F954B second address: 00000000008F954F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F954F second address: 00000000008F9555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F96B6 second address: 00000000008F96BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F96BC second address: 00000000008F96C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F96C2 second address: 00000000008F96DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244254h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F982E second address: 00000000008F9847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F41B1011B51h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F9847 second address: 00000000008F984B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F984B second address: 00000000008F984F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F984F second address: 00000000008F9855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F999A second address: 00000000008F99A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008FA397 second address: 00000000008FA39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008FCCE1 second address: 00000000008FCCFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F41B1011B46h 0x00000009 jmp 00007F41B1011B4Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009005B6 second address: 00000000009005BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009005BC second address: 00000000009005C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000901EE4 second address: 0000000000901F2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F41B1244253h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F41B1244251h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 jns 00007F41B124424Ch 0x0000001c pop eax 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jc 00007F41B1244246h 0x00000028 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000901F2C second address: 0000000000901F36 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000901F36 second address: 0000000000901F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000901F3A second address: 0000000000901F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000908D21 second address: 0000000000908D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000908EE4 second address: 0000000000908EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000908EEA second address: 0000000000908F04 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F41B124424Ch 0x0000000a pop ecx 0x0000000b js 00007F41B124424Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009092C3 second address: 00000000009092DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1011B54h 0x00000009 popad 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009095C6 second address: 00000000009095CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090C1D8 second address: 000000000090C20D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F41B1011B59h 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090C4D7 second address: 000000000090C4DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090C9DA second address: 000000000090C9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090CB42 second address: 000000000090CB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090CE3C second address: 000000000090CE40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090CE40 second address: 000000000090CE5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D000 second address: 000000000090D004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D004 second address: 000000000090D00A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D0B2 second address: 000000000090D0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D0B6 second address: 000000000090D0C6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D0C6 second address: 000000000090D0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jmp 00007F41B1011B53h 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D0E9 second address: 000000000090D0EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090D56C second address: 000000000090D588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090FA43 second address: 000000000090FA4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F41B1244246h 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090F7CA second address: 000000000090F7E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F41B1011B46h 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090F7E3 second address: 000000000090F7E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090F7E9 second address: 000000000090F7F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1011B4Bh 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091109A second address: 0000000000911122 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F41B1244246h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F41B1244248h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b xor edi, 73417491h 0x00000031 sub esi, 4CFAEF31h 0x00000037 push 00000000h 0x00000039 call 00007F41B124424Dh 0x0000003e jmp 00007F41B1244251h 0x00000043 pop edi 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebp 0x00000049 call 00007F41B1244248h 0x0000004e pop ebp 0x0000004f mov dword ptr [esp+04h], ebp 0x00000053 add dword ptr [esp+04h], 0000001Ch 0x0000005b inc ebp 0x0000005c push ebp 0x0000005d ret 0x0000005e pop ebp 0x0000005f ret 0x00000060 xchg eax, ebx 0x00000061 push eax 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000911122 second address: 0000000000911128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000911B4D second address: 0000000000911B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244250h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a nop 0x0000000b push esi 0x0000000c mov di, 6A76h 0x00000010 pop edi 0x00000011 push 00000000h 0x00000013 mov esi, eax 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D1AFEh], eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F41B1244251h 0x00000025 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091508D second address: 0000000000915092 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091512D second address: 0000000000915133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000915133 second address: 0000000000915138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000918158 second address: 0000000000918175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244252h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000918175 second address: 0000000000918179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091919A second address: 00000000009191A4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F41B124424Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000917310 second address: 0000000000917314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009182EC second address: 00000000009182F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000917314 second address: 000000000091731E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009182F1 second address: 000000000091836E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F41B1244248h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 jmp 00007F41B124424Ch 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov edi, 1ADFEEDBh 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b or bx, A9F6h 0x00000040 and bh, 00000000h 0x00000043 mov eax, dword ptr [ebp+122D0349h] 0x00000049 jl 00007F41B124424Ch 0x0000004f or edi, 1293C366h 0x00000055 or dword ptr [ebp+122D1A22h], ebx 0x0000005b push FFFFFFFFh 0x0000005d mov ebx, 5E184B38h 0x00000062 mov edi, dword ptr [ebp+122DB27Bh] 0x00000068 nop 0x00000069 push eax 0x0000006a js 00007F41B124424Ch 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091938C second address: 0000000000919399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009173EF second address: 00000000009173F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000919399 second address: 000000000091939D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091939D second address: 00000000009193A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091C474 second address: 000000000091C504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b jmp 00007F41B1011B59h 0x00000010 nop 0x00000011 and edi, 519317C0h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F41B1011B48h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 mov ebx, dword ptr [ebp+122D2F51h] 0x00000039 push 00000000h 0x0000003b jmp 00007F41B1011B53h 0x00000040 xchg eax, esi 0x00000041 push esi 0x00000042 jno 00007F41B1011B48h 0x00000048 pop esi 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091C504 second address: 000000000091C508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091C649 second address: 000000000091C64E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091E398 second address: 000000000091E3A9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091E3A9 second address: 000000000091E3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091F338 second address: 000000000091F347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091F347 second address: 000000000091F34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000921568 second address: 000000000092160B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244252h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F41B1244253h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F41B1244248h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F41B1244248h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 jmp 00007F41B1244253h 0x0000004c push 00000000h 0x0000004e and ebx, dword ptr [ebp+122D2A31h] 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jp 00007F41B1244258h 0x0000005d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091D6C1 second address: 000000000091D6C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091E514 second address: 000000000091E519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000091E519 second address: 000000000091E51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092259E second address: 00000000009225A8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009235A2 second address: 00000000009235A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009235A6 second address: 00000000009235B4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009235B4 second address: 00000000009235B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009235B8 second address: 00000000009235BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009244F6 second address: 00000000009244FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000923810 second address: 000000000092382A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F41B1244254h 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092382A second address: 000000000092382E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000924727 second address: 000000000092472B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092B76A second address: 000000000092B770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092B770 second address: 000000000092B774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092B774 second address: 000000000092B77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092B0B2 second address: 000000000092B0B7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092B0B7 second address: 000000000092B0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jng 00007F41B1011B4Ah 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092B0CC second address: 000000000092B0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092CD2B second address: 000000000092CD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092CD2F second address: 000000000092CD48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F41B124424Eh 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092CD48 second address: 000000000092CD6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F41B1011B46h 0x0000000a jmp 00007F41B1011B55h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092CD6C second address: 000000000092CD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B124424Bh 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000092CD7B second address: 000000000092CD7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000934824 second address: 0000000000934872 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F41B1244254h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007F41B124424Eh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F41B1244253h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F41B124424Ah 0x00000024 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000934A06 second address: 0000000000934A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000934A0A second address: 0000000000934A26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000934A26 second address: 0000000000934A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1011B4Ch 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000934A36 second address: 0000000000934A4A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000934A4A second address: 0000000000934A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000093968A second address: 0000000000939692 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000939692 second address: 00000000009396A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F41B1011B46h 0x0000000a ja 00007F41B1011B46h 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009396A2 second address: 00000000009396BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244259h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009396BF second address: 00000000009396C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009396C9 second address: 00000000009396CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009396CD second address: 00000000009396D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009396D1 second address: 00000000009396D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008C1A88 second address: 00000000008C1A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008C1A8C second address: 00000000008C1A94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008C1A94 second address: 00000000008C1AC1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F41B1011B4Dh 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F41B1011B58h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008C1AC1 second address: 00000000008C1AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008C1AC5 second address: 00000000008C1AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000938992 second address: 00000000009389A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F41B1244246h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009389A6 second address: 00000000009389D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007F41B1011B46h 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F41B1011B51h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007F41B1011B46h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009389D5 second address: 00000000009389F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244258h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000938B62 second address: 0000000000938B69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000938B69 second address: 0000000000938B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000938CBD second address: 0000000000938CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000938CC3 second address: 0000000000938D16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F41B1244254h 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F41B124424Ch 0x00000015 jmp 00007F41B124424Ch 0x0000001a jbe 00007F41B1244248h 0x00000020 push eax 0x00000021 push edx 0x00000022 jns 00007F41B1244246h 0x00000028 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009390DE second address: 00000000009390F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090A756 second address: 000000000090A75C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090A75C second address: 000000000090A760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090A760 second address: 000000000090A764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090A8E7 second address: 000000000090A8FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F41B1011B4Dh 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090ABC0 second address: 000000000075DA86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F41B1244248h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push dword ptr [ebp+122D1425h] 0x00000031 xor dx, 8910h 0x00000036 call dword ptr [ebp+122D265Dh] 0x0000003c pushad 0x0000003d mov dword ptr [ebp+122D3439h], ebx 0x00000043 xor eax, eax 0x00000045 jmp 00007F41B1244257h 0x0000004a mov edx, dword ptr [esp+28h] 0x0000004e jnc 00007F41B1244247h 0x00000054 mov dword ptr [ebp+122D2C65h], eax 0x0000005a mov dword ptr [ebp+122D2655h], eax 0x00000060 mov esi, 0000003Ch 0x00000065 jmp 00007F41B1244252h 0x0000006a mov dword ptr [ebp+122D2655h], ebx 0x00000070 add esi, dword ptr [esp+24h] 0x00000074 or dword ptr [ebp+122D1AA6h], ecx 0x0000007a lodsw 0x0000007c mov dword ptr [ebp+122D3439h], ebx 0x00000082 sub dword ptr [ebp+122D1891h], edi 0x00000088 add eax, dword ptr [esp+24h] 0x0000008c mov dword ptr [ebp+122D1891h], eax 0x00000092 mov ebx, dword ptr [esp+24h] 0x00000096 sub dword ptr [ebp+122D1AA6h], ecx 0x0000009c push eax 0x0000009d push ecx 0x0000009e push edx 0x0000009f push eax 0x000000a0 push edx 0x000000a1 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090ACDB second address: 000000000090ACF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F41B1011B51h 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090ACF6 second address: 000000000090ACFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090ACFC second address: 000000000075DA86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F41B1011B48h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 jmp 00007F41B1011B51h 0x0000002b push dword ptr [ebp+122D1425h] 0x00000031 mov cl, dh 0x00000033 call dword ptr [ebp+122D265Dh] 0x00000039 pushad 0x0000003a mov dword ptr [ebp+122D3439h], ebx 0x00000040 xor eax, eax 0x00000042 jmp 00007F41B1011B57h 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b jnc 00007F41B1011B47h 0x00000051 mov dword ptr [ebp+122D2C65h], eax 0x00000057 mov dword ptr [ebp+122D2655h], eax 0x0000005d mov esi, 0000003Ch 0x00000062 jmp 00007F41B1011B52h 0x00000067 mov dword ptr [ebp+122D2655h], ebx 0x0000006d add esi, dword ptr [esp+24h] 0x00000071 or dword ptr [ebp+122D1AA6h], ecx 0x00000077 lodsw 0x00000079 mov dword ptr [ebp+122D3439h], ebx 0x0000007f sub dword ptr [ebp+122D1891h], edi 0x00000085 add eax, dword ptr [esp+24h] 0x00000089 mov dword ptr [ebp+122D1891h], eax 0x0000008f mov ebx, dword ptr [esp+24h] 0x00000093 sub dword ptr [ebp+122D1AA6h], ecx 0x00000099 push eax 0x0000009a push ecx 0x0000009b push edx 0x0000009c push eax 0x0000009d push edx 0x0000009e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B024 second address: 000000000090B02E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B02E second address: 000000000090B033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B131 second address: 000000000090B135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B135 second address: 000000000090B13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B256 second address: 000000000090B2A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push ebx 0x0000000a mov ecx, 690FF56Ch 0x0000000f pop ecx 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F41B1244248h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c sub dword ptr [ebp+122D37DDh], ecx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 jmp 00007F41B124424Dh 0x0000003b pop eax 0x0000003c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B125 second address: 000000000090B131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B88D second address: 000000000090B891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008F0A1B second address: 00000000008F0A38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F41B1011B55h 0x0000000c pop ebx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000093FB8B second address: 000000000093FB95 instructions: 0x00000000 rdtsc 0x00000002 js 00007F41B1244246h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000093FDF7 second address: 000000000093FE18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F41B1011B54h 0x0000000a jo 00007F41B1011B46h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944A3D second address: 0000000000944A47 instructions: 0x00000000 rdtsc 0x00000002 js 00007F41B124424Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944A47 second address: 0000000000944A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944A4F second address: 0000000000944A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944BA5 second address: 0000000000944BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944BA9 second address: 0000000000944BBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F41B1244246h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944D0A second address: 0000000000944D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944D13 second address: 0000000000944D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B124424Ah 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000945185 second address: 00000000009451A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F41B1011B4Ch 0x0000000e jne 00007F41B1011B46h 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009451A0 second address: 00000000009451A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009451A4 second address: 00000000009451AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009451AA second address: 00000000009451B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009451B5 second address: 00000000009451C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F41B1011B46h 0x0000000a popad 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009451C0 second address: 00000000009451C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000944761 second address: 000000000094477A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1011B53h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094477A second address: 000000000094477E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009455FF second address: 0000000000945616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1011B53h 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D244 second address: 000000000094D248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094BC98 second address: 000000000094BC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C0F1 second address: 000000000094C10A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F41B124424Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C10A second address: 000000000094C10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C262 second address: 000000000094C26E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F41B1244246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C26E second address: 000000000094C295 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F41B1011B5Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C295 second address: 000000000094C2AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F41B1244250h 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C51E second address: 000000000094C522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C522 second address: 000000000094C52F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C64E second address: 000000000094C66B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F41B1011B4Bh 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094C797 second address: 000000000094C7C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Bh 0x00000007 jmp 00007F41B124424Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CA6C second address: 000000000094CA84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F41B1011B52h 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CA84 second address: 000000000094CA9F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnc 00007F41B1244246h 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CA9F second address: 000000000094CAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CAA3 second address: 000000000094CAE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F41B1244251h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F41B124424Dh 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CC2F second address: 000000000094CC39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CC39 second address: 000000000094CC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F41B1244246h 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CC4A second address: 000000000094CC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CC53 second address: 000000000094CC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1244259h 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094CC70 second address: 000000000094CC76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D07C second address: 000000000094D08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D08A second address: 000000000094D08F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D08F second address: 000000000094D095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D095 second address: 000000000094D099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D099 second address: 000000000094D09D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D09D second address: 000000000094D0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007F41B1011B4Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F41B1011B46h 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000094D0B8 second address: 000000000094D0CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F41B1244246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d js 00007F41B1244246h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008CBC4A second address: 00000000008CBC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008CBC50 second address: 00000000008CBC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009529FC second address: 0000000000952A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000952A00 second address: 0000000000952A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F41B1244253h 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000952A19 second address: 0000000000952A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000952A1E second address: 0000000000952A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009555F3 second address: 000000000095560A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F41B1011B4Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095560A second address: 0000000000955610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000955733 second address: 0000000000955740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009571DC second address: 00000000009571E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009571E4 second address: 00000000009571F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F41B1011B52h 0x0000000b jnl 00007F41B1011B46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009571F7 second address: 00000000009571FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009571FB second address: 0000000000957200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095CE0F second address: 000000000095CE22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F41B1244246h 0x00000013 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095CF57 second address: 000000000095CF5D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095D0B4 second address: 000000000095D0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F41B1244246h 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095D0BE second address: 000000000095D0C8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F41B1011B4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095D0C8 second address: 000000000095D0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095D0D4 second address: 000000000095D0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095D54B second address: 000000000095D550 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B40A second address: 000000000090B40E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B40E second address: 000000000090B45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+12480477h] 0x0000000e mov dword ptr [ebp+122D180Ch], eax 0x00000014 add eax, ebx 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F41B1244248h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov edx, dword ptr [ebp+122D2A51h] 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jl 00007F41B1244246h 0x00000040 jmp 00007F41B124424Ch 0x00000045 popad 0x00000046 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B45F second address: 000000000090B4D4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F41B1011B48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F41B1011B48h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 adc cx, 2800h 0x0000002c push 00000004h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F41B1011B48h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 nop 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F41B1011B59h 0x00000050 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000090B4D4 second address: 000000000090B4F2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F41B1244248h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jo 00007F41B1244248h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F41B1244246h 0x0000001e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095D82D second address: 000000000095D83D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push esi 0x00000008 jo 00007F41B1011B5Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095E2A5 second address: 000000000095E2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F41B1244251h 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095E2BC second address: 000000000095E2DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095E2DD second address: 000000000095E2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F41B1244246h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000095E2ED second address: 000000000095E319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1011B4Eh 0x00000009 jmp 00007F41B1011B58h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000008CD781 second address: 00000000008CD785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000961AA0 second address: 0000000000961AB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000961AB1 second address: 0000000000961AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000961AC3 second address: 0000000000961AD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B52h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964B70 second address: 0000000000964BC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F41B124425Ah 0x0000000f jmp 00007F41B1244253h 0x00000014 jg 00007F41B1244252h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964BC4 second address: 0000000000964BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964BCA second address: 0000000000964BDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964BDA second address: 0000000000964BF8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F41B1011B4Ch 0x00000008 pushad 0x00000009 jmp 00007F41B1011B4Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964BF8 second address: 0000000000964C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964EA9 second address: 0000000000964EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F41B1011B46h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F41B1011B46h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964EC0 second address: 0000000000964EC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964EC4 second address: 0000000000964ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F41B1011B46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964ED3 second address: 0000000000964F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F41B1244246h 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F41B124424Eh 0x00000014 jmp 00007F41B1244254h 0x00000019 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000964F03 second address: 0000000000964F2B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F41B1011B61h 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B35E second address: 000000000096B362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B362 second address: 000000000096B366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B366 second address: 000000000096B388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F41B1244246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F41B1244256h 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B388 second address: 000000000096B38D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B38D second address: 000000000096B393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B8AC second address: 000000000096B8F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F41B1011B46h 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007F41B1011B46h 0x00000011 popad 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 jmp 00007F41B1011B52h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F41B1011B4Dh 0x00000027 jmp 00007F41B1011B4Eh 0x0000002c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B8F6 second address: 000000000096B8FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B8FA second address: 000000000096B90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F41B1011B4Ch 0x0000000c jl 00007F41B1011B46h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096B90F second address: 000000000096B91B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096BBB4 second address: 000000000096BBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F41B1011B52h 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F41B1011B4Ah 0x0000001d pushad 0x0000001e jmp 00007F41B1011B54h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096BEB6 second address: 000000000096BEBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096BEBC second address: 000000000096BEC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096BEC2 second address: 000000000096BEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jno 00007F41B1244246h 0x0000000f jg 00007F41B1244246h 0x00000015 jmp 00007F41B1244257h 0x0000001a popad 0x0000001b pop esi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096BEF5 second address: 000000000096BEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096BEF9 second address: 000000000096BF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096C4A1 second address: 000000000096C4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000096C4A5 second address: 000000000096C4C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244257h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000971A38 second address: 0000000000971A57 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F41B1011B46h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F41B1011B50h 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000971A57 second address: 0000000000971A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F41B1244259h 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000971A7C second address: 0000000000971A8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F41B1011B4Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000974EB5 second address: 0000000000974EDB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F41B124424Bh 0x00000008 jmp 00007F41B124424Ch 0x0000000d pop ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007F41B1244246h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000974EDB second address: 0000000000974F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F41B1011B52h 0x00000010 push esi 0x00000011 je 00007F41B1011B46h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007F41B1011B46h 0x00000020 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009751CD second address: 00000000009751D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009751D1 second address: 000000000097520A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F41B1011B5Dh 0x00000008 jmp 00007F41B1011B4Bh 0x0000000d jmp 00007F41B1011B4Ch 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F41B1011B4Eh 0x0000001d jo 00007F41B1011B46h 0x00000023 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097520A second address: 0000000000975223 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244255h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000975223 second address: 000000000097523D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F41B1011B46h 0x00000009 jmp 00007F41B1011B4Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000975388 second address: 00000000009753CC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F41B124424Eh 0x00000008 js 00007F41B124424Eh 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F41B1244246h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jo 00007F41B1244274h 0x0000001e jng 00007F41B124425Bh 0x00000024 jmp 00007F41B1244255h 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097B688 second address: 000000000097B6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F41B1011B59h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007F41B1011B50h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097B6C1 second address: 000000000097B6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097B6C7 second address: 000000000097B6CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097B6CB second address: 000000000097B6E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Fh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097BA03 second address: 000000000097BA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097BF95 second address: 000000000097BF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097BF9D second address: 000000000097BFAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jbe 00007F41B1011B46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097BFAE second address: 000000000097BFB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097C42E second address: 000000000097C444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B52h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097C444 second address: 000000000097C452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F41B124424Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097C452 second address: 000000000097C456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097C456 second address: 000000000097C45D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097C45D second address: 000000000097C466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097C466 second address: 000000000097C46A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000097CB89 second address: 000000000097CBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F41B1011B52h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000098123E second address: 000000000098124F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F41B1244248h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000098124F second address: 0000000000981269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1011B56h 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000985AC8 second address: 0000000000985AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000985DB7 second address: 0000000000985DCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B50h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000985DCB second address: 0000000000985DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pushad 0x0000000b jne 00007F41B1244246h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 jo 00007F41B1244264h 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000985DE9 second address: 0000000000985DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000098D23D second address: 000000000098D243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000098D243 second address: 000000000098D247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000098D247 second address: 000000000098D24C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000997DB2 second address: 0000000000997DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F41B1011B56h 0x0000000c popad 0x0000000d push ebx 0x0000000e push ebx 0x0000000f jns 00007F41B1011B46h 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000997912 second address: 0000000000997919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000997AAF second address: 0000000000997AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099A7E5 second address: 000000000099A7EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099A7EC second address: 000000000099A810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jl 00007F41B1011B46h 0x0000000c jmp 00007F41B1011B51h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099A200 second address: 000000000099A21D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244255h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099A21D second address: 000000000099A221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EE7E second address: 000000000099EE84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EE84 second address: 000000000099EEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F41B1011B58h 0x0000000c pop eax 0x0000000d rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EEA4 second address: 000000000099EEBE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F41B1244246h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F41B1244246h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EEBE second address: 000000000099EEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EEC2 second address: 000000000099EEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EEC6 second address: 000000000099EED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F41B1011B46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EED2 second address: 000000000099EEE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B124424Ch 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EEE2 second address: 000000000099EEFD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007F41B1011B46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F41B1011B4Dh 0x00000013 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000099EEFD second address: 000000000099EF01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009AA8EF second address: 00000000009AA8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009AA736 second address: 00000000009AA77B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F41B1244261h 0x00000008 jnp 00007F41B1244246h 0x0000000e jmp 00007F41B1244255h 0x00000013 jmp 00007F41B124424Dh 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F41B1244251h 0x00000021 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACCC0 second address: 00000000009ACCEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F41B1011B4Dh 0x00000008 jmp 00007F41B1011B4Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F41B1011B46h 0x00000018 jo 00007F41B1011B46h 0x0000001e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACCEB second address: 00000000009ACCEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACCEF second address: 00000000009ACD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1011B4Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACD0C second address: 00000000009ACD2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1244258h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACD2A second address: 00000000009ACD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACB6B second address: 00000000009ACB6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009ACB6F second address: 00000000009ACB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F41B1011B56h 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B5BD3 second address: 00000000009B5BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F41B1244253h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B5BF1 second address: 00000000009B5BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B5BF5 second address: 00000000009B5BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B477F second address: 00000000009B4783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4783 second address: 00000000009B4795 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop edi 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4A16 second address: 00000000009B4A43 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F41B1011B61h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F41B1011B46h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4A43 second address: 00000000009B4A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4B91 second address: 00000000009B4B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4B97 second address: 00000000009B4B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4D10 second address: 00000000009B4D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F41B1011B4Dh 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4E94 second address: 00000000009B4E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B4E98 second address: 00000000009B4E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B967B second address: 00000000009B967F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B927A second address: 00000000009B9280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B9280 second address: 00000000009B9285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009B9285 second address: 00000000009B92A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B50h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F41B1011B46h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009CDE27 second address: 00000000009CDE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009CDE2B second address: 00000000009CDE35 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F41B1011B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009CDE35 second address: 00000000009CDE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009CDE3B second address: 00000000009CDE3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009CDE3F second address: 00000000009CDE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F41B1244254h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e jnp 00007F41B1244257h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009D05F5 second address: 00000000009D0639 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F41B1011B57h 0x0000000e je 00007F41B1011B61h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F41B1011B59h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009C9DAA second address: 00000000009C9DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000009C9DB5 second address: 00000000009C9DC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A04B68 second address: 0000000000A04B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A04B6C second address: 0000000000A04B8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F41B1011B4Eh 0x0000000f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A04CF4 second address: 0000000000A04D0B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F41B1244246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A04D0B second address: 0000000000A04D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F41B1011B52h 0x0000000c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A04D23 second address: 0000000000A04D52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F41B1244246h 0x0000000b pop edi 0x0000000c pushad 0x0000000d jmp 00007F41B124424Ch 0x00000012 jmp 00007F41B1244254h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A05056 second address: 0000000000A05064 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F41B1011B4Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A051C5 second address: 0000000000A051FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F41B1244259h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F41B1244257h 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A08632 second address: 0000000000A08636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A088BF second address: 0000000000A088C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A088C5 second address: 0000000000A08930 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F41B1011B48h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dx, 514Bh 0x0000002c push 00000004h 0x0000002e add edx, dword ptr [ebp+1244A582h] 0x00000034 mov edx, ebx 0x00000036 call 00007F41B1011B49h 0x0000003b jnl 00007F41B1011B56h 0x00000041 push eax 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 push esi 0x00000046 pop esi 0x00000047 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A08930 second address: 0000000000A08952 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jmp 00007F41B124424Dh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A08952 second address: 0000000000A0898E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F41B1011B4Ah 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F41B1011B55h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push ecx 0x00000018 jns 00007F41B1011B46h 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jp 00007F41B1011B46h 0x00000027 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A08BF3 second address: 0000000000A08BF8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A0B5F2 second address: 0000000000A0B602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jno 00007F41B1011B46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A0B602 second address: 0000000000A0B608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A0B608 second address: 0000000000A0B63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jnl 00007F41B1011B4Eh 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 je 00007F41B1011B52h 0x00000019 jmp 00007F41B1011B4Ch 0x0000001e push ebx 0x0000001f push edi 0x00000020 pop edi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000000A0D5E7 second address: 0000000000A0D5FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244250h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F0703 second address: 00000000050F0707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F0707 second address: 00000000050F070D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F070D second address: 00000000050F0713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F0713 second address: 00000000050F0741 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ecx, 4B0DD3E3h 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ebx 0x00000015 mov di, si 0x00000018 popad 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F0741 second address: 00000000050F0745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F0745 second address: 00000000050F074B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050F074B second address: 00000000050F0779 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F41B1011B57h 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130644 second address: 0000000005130685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F41B1244256h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F41B1244250h 0x00000016 pop ebp 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a mov ecx, 4B4E9303h 0x0000001f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050C0B72 second address: 00000000050C0B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050C0B76 second address: 00000000050C0B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050C0B7C second address: 00000000050C0C37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F41B1011B55h 0x00000009 adc esi, 3FA36836h 0x0000000f jmp 00007F41B1011B51h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esp 0x00000019 jmp 00007F41B1011B4Ah 0x0000001e mov dword ptr [esp], ebp 0x00000021 jmp 00007F41B1011B50h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F41B1011B4Eh 0x0000002f adc cx, C1B8h 0x00000034 jmp 00007F41B1011B4Bh 0x00000039 popfd 0x0000003a pushfd 0x0000003b jmp 00007F41B1011B58h 0x00000040 sub esi, 4FBA7C18h 0x00000046 jmp 00007F41B1011B4Bh 0x0000004b popfd 0x0000004c popad 0x0000004d push dword ptr [ebp+04h] 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F41B1011B55h 0x00000057 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B09 second address: 0000000005100B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B0F second address: 0000000005100B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F41B1011B4Dh 0x00000013 add ecx, 59758796h 0x00000019 jmp 00007F41B1011B51h 0x0000001e popfd 0x0000001f movzx ecx, dx 0x00000022 popad 0x00000023 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B55 second address: 0000000005100B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B5A second address: 0000000005100B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, bx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B6B second address: 0000000005100B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B71 second address: 0000000005100B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F41B1011B4Fh 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F41B1011B50h 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100B9D second address: 0000000005100BA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005150035 second address: 000000000515003B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000515003B second address: 000000000515003F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000515003F second address: 00000000051500A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F41B1011B4Fh 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 call 00007F41B1011B54h 0x00000018 mov cx, A0F1h 0x0000001c pop eax 0x0000001d mov cx, bx 0x00000020 popad 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ax, A861h 0x00000029 pushfd 0x0000002a jmp 00007F41B1011B4Eh 0x0000002f add ax, 0AF8h 0x00000034 jmp 00007F41B1011B4Bh 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051500A2 second address: 00000000051500A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051500A8 second address: 00000000051500AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130B57 second address: 0000000005130B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4BFD6BA4h 0x00000008 push ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov bl, ch 0x00000013 movsx edi, ax 0x00000016 popad 0x00000017 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130B6E second address: 0000000005130B74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130B74 second address: 0000000005130B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130B78 second address: 0000000005130BA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov edx, 03D1091Eh 0x00000015 jmp 00007F41B1011B4Fh 0x0000001a popad 0x0000001b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130BA9 second address: 0000000005130BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130BAF second address: 0000000005130BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130BB3 second address: 0000000005130BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130BB7 second address: 0000000005130BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, di 0x0000000f popad 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130BC7 second address: 0000000005130BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050D02B2 second address: 00000000050D0316 instructions: 0x00000000 rdtsc 0x00000002 call 00007F41B1011B53h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebp 0x0000000c pushad 0x0000000d jmp 00007F41B1011B52h 0x00000012 pushfd 0x00000013 jmp 00007F41B1011B52h 0x00000018 and al, 00000018h 0x0000001b jmp 00007F41B1011B4Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 pushad 0x00000026 mov edx, eax 0x00000028 mov esi, 64BFBCC7h 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050D0316 second address: 00000000050D031C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050D031C second address: 00000000050D0322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000050D0322 second address: 00000000050D0326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130453 second address: 0000000005130457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130457 second address: 000000000513045B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000513045B second address: 0000000005130461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130461 second address: 0000000005130476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130476 second address: 000000000513047C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000513047C second address: 0000000005130482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130482 second address: 0000000005130486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130486 second address: 00000000051304D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F41B124424Dh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 call 00007F41B124424Ch 0x00000016 pushfd 0x00000017 jmp 00007F41B1244252h 0x0000001c xor si, D448h 0x00000021 jmp 00007F41B124424Bh 0x00000026 popfd 0x00000027 pop eax 0x00000028 push eax 0x00000029 push edx 0x0000002a mov ebx, 3969DDEAh 0x0000002f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130AA0 second address: 0000000005130AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 8FE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130C68 second address: 0000000005130C85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130C85 second address: 0000000005130CDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F41B1011B4Dh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F41B1011B58h 0x00000018 pushfd 0x00000019 jmp 00007F41B1011B52h 0x0000001e add cx, 3558h 0x00000023 jmp 00007F41B1011B4Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409B5 second address: 00000000051409B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409B9 second address: 00000000051409BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409BD second address: 00000000051409C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409C3 second address: 00000000051409C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409C9 second address: 00000000051409CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409CD second address: 00000000051409EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F41B1011B56h 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051409EE second address: 0000000005140A15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F41B1244255h 0x00000011 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140A15 second address: 0000000005140A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1011B4Ch 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140A25 second address: 0000000005140A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140A29 second address: 0000000005140A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140A39 second address: 0000000005140A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140A3F second address: 0000000005140A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1011B4Eh 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140A51 second address: 0000000005140AE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F41B1244258h 0x00000011 xor esi, 2C1C17E8h 0x00000017 jmp 00007F41B124424Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F41B1244258h 0x00000023 add ax, AA48h 0x00000028 jmp 00007F41B124424Bh 0x0000002d popfd 0x0000002e popad 0x0000002f pushfd 0x00000030 jmp 00007F41B1244258h 0x00000035 add ah, FFFFFFA8h 0x00000038 jmp 00007F41B124424Bh 0x0000003d popfd 0x0000003e popad 0x0000003f mov dword ptr [esp], ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 movsx ebx, cx 0x00000048 movzx ecx, bx 0x0000004b popad 0x0000004c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140AE8 second address: 0000000005140B33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [774365FCh] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F41B1011B56h 0x00000015 pushfd 0x00000016 jmp 00007F41B1011B52h 0x0000001b add ax, 1498h 0x00000020 jmp 00007F41B1011B4Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140B33 second address: 0000000005140B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1244254h 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140B4B second address: 0000000005140B69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a pushad 0x0000000b mov bl, 75h 0x0000000d mov ax, FBC5h 0x00000011 popad 0x00000012 je 00007F422328494Fh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140B69 second address: 0000000005140B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005140B6D second address: 0000000005140B73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130ECD second address: 0000000005130F05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, 5Bh 0x0000000d mov ecx, edi 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F41B1244251h 0x00000018 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130F05 second address: 0000000005130F25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 55C2h 0x00000007 mov al, dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F41B1011B51h 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005130F25 second address: 0000000005130F47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ebx, 10164A1Eh 0x00000013 mov eax, edx 0x00000015 popad 0x00000016 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100032 second address: 0000000005100078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F41B1011B4Eh 0x00000011 sbb cx, 5988h 0x00000016 jmp 00007F41B1011B4Bh 0x0000001b popfd 0x0000001c movzx esi, di 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100078 second address: 000000000510007C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510007C second address: 0000000005100082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100082 second address: 0000000005100088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100088 second address: 000000000510008C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510008C second address: 0000000005100090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100090 second address: 00000000051000B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F41B1011B58h 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051000B5 second address: 00000000051000BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051000BB second address: 0000000005100123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F41B1011B56h 0x0000000e mov dword ptr [esp], ecx 0x00000011 pushad 0x00000012 mov si, CEFDh 0x00000016 movzx esi, dx 0x00000019 popad 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F41B1011B57h 0x00000024 or cx, 069Eh 0x00000029 jmp 00007F41B1011B59h 0x0000002e popfd 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100123 second address: 0000000005100128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100128 second address: 000000000510016A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov bh, EDh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e jmp 00007F41B1011B50h 0x00000013 mov ebx, dword ptr [ebp+10h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F41B1011B4Dh 0x0000001f jmp 00007F41B1011B4Bh 0x00000024 popfd 0x00000025 mov dx, ax 0x00000028 popad 0x00000029 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510016A second address: 000000000510017E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F41B1244250h 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510017E second address: 00000000051001F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F41B1011B56h 0x00000011 push eax 0x00000012 jmp 00007F41B1011B4Bh 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007F41B1011B4Bh 0x00000020 pop eax 0x00000021 pushfd 0x00000022 jmp 00007F41B1011B59h 0x00000027 add ah, 00000006h 0x0000002a jmp 00007F41B1011B51h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051001F2 second address: 0000000005100263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007F41B124424Eh 0x00000011 xchg eax, edi 0x00000012 pushad 0x00000013 mov dh, ch 0x00000015 mov edi, 2144F0EEh 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F41B1244254h 0x00000021 xchg eax, edi 0x00000022 jmp 00007F41B1244250h 0x00000027 test esi, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F41B1244257h 0x00000030 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100263 second address: 0000000005100269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100269 second address: 0000000005100285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F42234F25E1h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100285 second address: 000000000510028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, bx 0x00000007 popad 0x00000008 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510028D second address: 0000000005100293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100293 second address: 0000000005100322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 jmp 00007F41B1011B50h 0x00000017 je 00007F42232BFEADh 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F41B1011B4Dh 0x00000024 sbb ecx, 3378FBF6h 0x0000002a jmp 00007F41B1011B51h 0x0000002f popfd 0x00000030 popad 0x00000031 mov edx, dword ptr [esi+44h] 0x00000034 pushad 0x00000035 mov bh, 8Ch 0x00000037 popad 0x00000038 or edx, dword ptr [ebp+0Ch] 0x0000003b jmp 00007F41B1011B52h 0x00000040 test edx, 61000000h 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F41B1011B4Ah 0x0000004f rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100322 second address: 0000000005100328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100328 second address: 0000000005100349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F41B1011B4Ch 0x00000009 add ah, FFFFFFA8h 0x0000000c jmp 00007F41B1011B4Bh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005100349 second address: 000000000510038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F42234F257Eh 0x0000000d jmp 00007F41B1244254h 0x00000012 test byte ptr [esi+48h], 00000001h 0x00000016 jmp 00007F41B1244250h 0x0000001b jne 00007F42234F2569h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510038A second address: 000000000510038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000510038E second address: 0000000005100394 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511005E second address: 00000000051100FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F41B1011B57h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e pushad 0x0000000f mov ah, 49h 0x00000011 call 00007F41B1011B57h 0x00000016 mov eax, 71DC891Fh 0x0000001b pop ecx 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f call 00007F41B1011B50h 0x00000024 pushfd 0x00000025 jmp 00007F41B1011B52h 0x0000002a sub ax, 05B8h 0x0000002f jmp 00007F41B1011B4Bh 0x00000034 popfd 0x00000035 pop ecx 0x00000036 mov ebx, 1D5B5CFCh 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d jmp 00007F41B1011B4Bh 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F41B1011B50h 0x0000004c rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051100FD second address: 0000000005110101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110101 second address: 0000000005110107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110107 second address: 0000000005110124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F41B124424Ch 0x00000008 pop eax 0x00000009 mov si, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110124 second address: 000000000511012A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511012A second address: 0000000005110130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110130 second address: 0000000005110134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110134 second address: 000000000511014B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B124424Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511014B second address: 000000000511014F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511014F second address: 0000000005110155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110155 second address: 0000000005110189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007F41B1011B58h 0x00000011 sub ebx, ebx 0x00000013 pushad 0x00000014 mov esi, edi 0x00000016 movsx ebx, ax 0x00000019 popad 0x0000001a test esi, esi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f mov al, 20h 0x00000021 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110189 second address: 0000000005110235 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F41B1244253h 0x00000008 sbb ax, 1A5Eh 0x0000000d jmp 00007F41B1244259h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov esi, 06176B27h 0x0000001a popad 0x0000001b je 00007F42234DA40Eh 0x00000021 pushad 0x00000022 mov dx, ax 0x00000025 call 00007F41B1244254h 0x0000002a mov cx, D321h 0x0000002e pop ecx 0x0000002f popad 0x00000030 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000037 pushad 0x00000038 movsx edi, ax 0x0000003b mov esi, 40E64F1Bh 0x00000040 popad 0x00000041 mov ecx, esi 0x00000043 jmp 00007F41B124424Eh 0x00000048 je 00007F42234DA3DEh 0x0000004e pushad 0x0000004f push ecx 0x00000050 jmp 00007F41B124424Dh 0x00000055 pop eax 0x00000056 mov cx, dx 0x00000059 popad 0x0000005a test byte ptr [77436968h], 00000002h 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 mov ebx, eax 0x00000066 mov di, cx 0x00000069 popad 0x0000006a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110235 second address: 0000000005110252 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F42232A7CB6h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 movzx esi, dx 0x00000015 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110252 second address: 000000000511025D instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 mov edx, eax 0x0000000b rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511025D second address: 000000000511026D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, dword ptr [ebp+0Ch] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511026D second address: 0000000005110271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110271 second address: 0000000005110277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110277 second address: 000000000511027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511027D second address: 0000000005110281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110281 second address: 00000000051102C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1244254h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F41B1244250h 0x00000011 push eax 0x00000012 pushad 0x00000013 call 00007F41B1244251h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051102C1 second address: 0000000005110333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dl, 94h 0x00000007 popad 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F41B1011B56h 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007F41B1011B4Ah 0x00000019 xor eax, 337EDE28h 0x0000001f jmp 00007F41B1011B4Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov bl, al 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007F41B1011B52h 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F41B1011B57h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110333 second address: 0000000005110356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov edi, 645147A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+14h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F41B124424Fh 0x00000019 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110356 second address: 000000000511035A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 000000000511035A second address: 0000000005110360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110360 second address: 0000000005110369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 5FE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 0000000005110395 second address: 00000000051103E8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F41B1244256h 0x00000008 and cx, 3A08h 0x0000000d jmp 00007F41B124424Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ebx, ecx 0x00000017 popad 0x00000018 pop ebx 0x00000019 pushad 0x0000001a mov esi, 2902E877h 0x0000001f jmp 00007F41B124424Ch 0x00000024 popad 0x00000025 mov esp, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F41B124424Ah 0x00000030 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051103E8 second address: 00000000051103F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F41B1011B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051103F7 second address: 00000000051103FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRDTSC instruction interceptor: First address: 00000000051103FD second address: 0000000005110401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
              Tries to evade debugger and weak emulator (self modifying code)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSpecial instruction interceptor: First address: 000000000075DA9C instructions caused by: Self-modifying code
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSpecial instruction interceptor: First address: 000000000075DA08 instructions caused by: Self-modifying code
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSpecial instruction interceptor: First address: 0000000000988590 instructions caused by: Self-modifying code
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSpecial instruction interceptor: First address: 0000000000900368 instructions caused by: Self-modifying code
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000004DDA9C instructions caused by: Self-modifying code
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000004DDA08 instructions caused by: Self-modifying code
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 0000000000708590 instructions caused by: Self-modifying code
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 0000000000680368 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 000000000114DA9C instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 000000000114DA08 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000001378590 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 00000000012F0368 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 000000000018DA87 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 000000000018DBA8 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 000000000018DAA9 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 000000000035EE7A instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 00000000003C9A5E instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 0000000000194E5E instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeSpecial instruction interceptor: First address: 0000000000194BB5 instructions caused by: Self-modifying code
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeMemory allocated: 5170000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeMemory allocated: 54E0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeMemory allocated: 74E0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_050A0BD4 rdtsc 0_2_050A0BD4
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeThread delayed: delay time: 922337203685477
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1294Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1539Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1684Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1648Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeWindow / User API: threadDelayed 4552
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\b2H5rX9tWHjbJEBjMEvH.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\61EWU8OcULp0D6CDdq0e.exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\well[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ladas[1].exeJump to dropped file
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeEvasive API call chain: RegOpenKey,DecisionNodes,ExitProcessgraph_0-74838
              Source: C:\Users\user\Desktop\jk98mGM6JH.exe TID: 6636Thread sleep time: -34017s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exe TID: 5236Thread sleep count: 111 > 30Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exe TID: 5836Thread sleep time: -36018s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exe TID: 6672Thread sleep time: -30015s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exe TID: 5236Thread sleep count: 74 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3184Thread sleep count: 100 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3184Thread sleep time: -200100s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6960Thread sleep time: -44000s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5280Thread sleep count: 73 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3080Thread sleep count: 1294 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3080Thread sleep time: -2589294s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2444Thread sleep count: 1539 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2444Thread sleep time: -3079539s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3816Thread sleep count: 1684 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3816Thread sleep time: -3369684s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5920Thread sleep count: 1648 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5920Thread sleep time: -3297648s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2268Thread sleep time: -38019s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3472Thread sleep time: -46023s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1432Thread sleep time: -48000s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5160Thread sleep count: 71 > 30Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3224Thread sleep time: -50025s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6368Thread sleep time: -48024s >= -30000sJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1804Thread sleep time: -50025s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1464Thread sleep count: 103 > 30
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe TID: 5092Thread sleep time: -45520s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe TID: 8380Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeLast function: Thread delayed
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeThread sleep count: Count: 4552 delay: -10
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0061C000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,0_2_0061C000
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006EB3B5 recv,FindFirstFileExW,0_2_006EB3B5
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0039C000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,10_2_0039C000
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_0046B3B5 recv,FindFirstFileExW,10_2_0046B3B5
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeThread delayed: delay time: 922337203685477
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nickname.utiitsl.comVMware20,1169648755
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: #Windows 10 Microsoft Hyper-V Server
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ra Change Transaction PasswordVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696
              Source: jk98mGM6JH.exe, 00000000.00000003.2208291188.0000000006040000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMCitrio
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: vmware
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000071E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000EM
              Source: RageMP131.exe, 00000022.00000002.2657858021.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lhzl\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .utiitsl.comVMware20,1169648755
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,1169648755
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: "Windows 8 Microsoft Hyper-V Server
              Source: jk98mGM6JH.exe, 00000000.00000003.2203839905.0000000006030000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PREFER~2KPreferencesLGFaviconsgkGAyEwjLgMyw6tzUlM8BEgYIABABIBAyEwjgueKkncrr444BEgYIABABIBAyFAinx8vZpLm+gcMBEgcIARABIJBgMhII5s79rcCI/IJ+EgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDIWCJiYntn49dXkggESCQgAEAEggICACHoCCACCAQIYAA==","saved_system_profile_hash":"1C7CAA303FB4F30A304BA4E68CF94DA878BD3A61","stats_buildtime":"1696412494","stats_version":"117.0.2045.55-64","system_crash_count":0},"unsent_log_metadata":{"initial_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0},"ongoing_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0}}},"variations_compressed_seed":"H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
              Source: jk98mGM6JH.exe, 00000000.00000003.2196455155.0000000006039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: inGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZx
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
              Source: MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000s\user\AppData\Local\Temp
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,116
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000003.2509698184.000000000075F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}N
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Microsoft Hyper-V Server
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2201571662.000000000602C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gkGAyEwjLgMyw6tzUlM8BEgYIABABIBAyEwjgueKkncrr444BEgYIABABIBAyFAinx8vZpLm+gcMBEgcIARABIJBgMhII5s79rcCI/IJ+EgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDIWCJiYntn49dXkggESCQgAEAEggICACHoCCACCAQIYAA==","saved_system_profile_hash":"1C7CAA303FB4F30A304BA4E68CF94DA878BD3A61","stats_buildtime":"1696412494","stats_version":"117.0.2045.55-64","system_crash_count":0},"unsent_log_metadata":{"initial_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0},"ongoing_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0}}},"variations_compressed_seed":"H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7ar
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000010E2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: ]DLL_Loader_VirtualMachine
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Microsoft Hyper-V Server
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: )Windows 8 Server Standard without Hyper-V
              Source: jk98mGM6JH.exe, 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 0000000A.00000002.3051572033.000000000065E000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000D.00000002.2541378300.00000000012CE000.00000040.00000001.01000000.00000007.sdmp, zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000002.2646185724.0000000000316000.00000040.00000001.01000000.0000000B.sdmp, RageMP131.exe, 00000022.00000002.2671590915.00000000012CE000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: ,Windows 2012 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Microsoft Hyper-V Server
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: r global passwords blocklistVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: formVMware20,11696487552
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010DD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Server Standard without Hyper-V (core)
              Source: RageMP131.exe, 00000022.00000003.2549203345.00000000006A8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rootpagecomVMware20,11696487552o
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tive Brokers - non-EU EuropeVMware20,11696487552
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_E8D9B274
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.000000000109B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: xVBoxService.exe
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Server Standard without Hyper-V
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: VMWare
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: #Windows 11 Microsoft Hyper-V Server
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Essential Server Solutions without Hyper-V
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000BE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000J\
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: billing_address_id.comVMware20,11696487
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696H0
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Microsoft Hyper-V Server
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWn
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Microsoft Hyper-V Server
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Microsoft Hyper-V Server
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C4D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWa
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}efault_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT087cq/n0b4cx5g+QK3FvYl+MX6lBiIKAgvXttf1DH+989/DfjSv6Bq3DYuxcAa55qtt7c5CvCG+LwRguGiK4StuVCVc6XgB5WXXwqsj3qDuW4Cf/pUPGulNsSUbVjnJXLSDRa6CR/hKQBmFkJLHQQsYPMFLA0wE+qP3/8dP8jfiPM3Ft4I0gGtrBhve6DpxPdSGSe6LyTLaksmvPj6AByWNap2XijrDgRIkyxnvOenLXHtAupwODCcM8S8KwJktambXH7du0NQvoKDbZnzDWV9XluhgbnLCK/NOuMauHTKJlXFKh4UcM2Nd34B1ruTNoazRsc2VUyvcK0LuDb25m1UYYMsXMBYBeS95xZmIu0Mjueg/abgcwHkROSgEsMCUZwAidB1CX96+giihcXq1JOPZpqawYXgXQSmbf1UUBHCa+KhAhsGPEmo2b2WlIsP+SG8/MNLfBqrpOYMBxJxQOpx9ZnUwE97DqoY/nhJYSwwTgEyYc8bddtrewuzAB+9DfpEpTdfQT/cxR8AMzo9KKn5+oPbgH+UVm/AagvIhYJqEfRMxf5ABhyQsPtNJNladC+rIsDHZYhNYNA8Cs9pW+PZgATFXFTpdCoCBk2mA6zaYBYbwI1xlSuCtGPU/Rbd34BVMWyoS5uIDM+nfN4qG8NY6ugTd4qX4ZPRQ8d92ROotox3W+cbhjJ0UBXIO/SH3iagkaPKm2TR01+OMarxDkQf+hHBQ98UfTZge+UFl/DF/WSFYRV96ZXXwEMtsIWiJXSuH/iW/L5FNWzZJaPpTqrBleGkVFGXkVYLj6jsnkDuew56AWPnJ22VSfrESy8aJKTCO27VEHSVPJdl8AJQfOAbEtPWbXFtRvjZFNI9XoaaTYDjUrZsv9ruQWYofdQcvnl8RCl+hHQiO0ZRuJxFlb0PmX0WJeID100wGgStEsmy1hYFYDby1j1jz30plwP67QanQ8d8IgM7UJ1K+Ebj+Ib/Y1MaVoAe3E4vo4SSTPjtJlWgiB7iey44K8v3hQpEWyYRV7DPKo2bFqJL8LOq9uHVY8oaTTmTOvDKfLlApDIr8s7C13s+fEqozzwdJIyNFpQpwgZTX/g+HlyqNvjqAsy29X5pUV9au598WqMToJ3A/lfJ0gIYEBOlNrjd4kzwIB4hXwtgj1m5F0CsblnjVpyOSytDBOX97qCqsKm9L8JK9FJlFyllzgrYgc3+KKblk6G4EOmgeGzpq4R
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ebrokers.co.inVMware20,11696487552d
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: s.portal.azure.comVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, jk98mGM6JH.exe, 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 0000000A.00000002.3051572033.000000000065E000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000D.00000002.2541378300.00000000012CE000.00000040.00000001.01000000.00000007.sdmp, zqdrYwv5fC6zkQ9Tresm.exe, 00000019.00000002.2646185724.0000000000316000.00000040.00000001.01000000.0000000B.sdmp, RageMP131.exe, 00000022.00000002.2671590915.00000000012CE000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000003.2509698184.0000000000757000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Hyper-V (guest)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: comVMware20,11696487552o
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,116p-
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000010E2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: ~VirtualMachineTypes
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_E8D9B274)S
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000010E2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Server Standard without Hyper-V
              Source: jk98mGM6JH.exe, 00000000.00000003.2203839905.0000000006030000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gkGAyEwjLgMyw6tzUlM8BEgYIABABIBAyEwjgueKkncrr444BEgYIABABIBAyFAinx8vZpLm+gcMBEgcIARABIJBgMhII5s79rcCI/IJ+EgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDIWCJiYntn49dXkggESCQgAEAEggICACHoCCACCAQIYAA==","saved_system_profile_hash":"1C7CAA303FB4F30A304BA4E68CF94DA878BD3A61","stats_buildtime":"1696412494","stats_version":"117.0.2045.55-64","system_crash_count":0},"unsent_log_metadata":{"initial_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0},"ongoing_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0}}},"variations_compressed_seed":"H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7ar
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: %Windows 2012 Microsoft Hyper-V Server
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: $Windows 8.1 Microsoft Hyper-V Server
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000003.2509698184.000000000075F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pageformVMware20,11696487552
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_E8D9B274
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: %Windows 2016 Microsoft Hyper-V Server
              Source: MPGPH131.exe, 00000009.00000003.2193634968.0000000000E48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}i
              Source: jk98mGM6JH.exe, 00000000.00000003.2149654269.00000000010AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}e
              Source: MPGPH131.exe, 0000000A.00000002.3121450909.00000000072D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\G
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: +Windows 8.1 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000759000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}O
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
              Source: RageMP131.exe, 0000000D.00000002.2536747684.0000000000C2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}L
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2199073228.000000000604D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .comVMware20,11696487
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: *Windows 11 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: ,Windows 2016 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: VBoxService.exe
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.000000000109B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: *Windows 10 Server Standard without Hyper-V
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o.inVMware20,11696487552~
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
              Source: jk98mGM6JH.exe, 00000000.00000003.2195881504.0000000006057000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
              Source: jk98mGM6JH.exe, 00000000.00000003.2201571662.000000000602C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PREFER~2KPreferencesLGFaviconsgkGAyEwjLgMyw6tzUlM8BEgYIABABIBAyEwjgueKkncrr444BEgYIABABIBAyFAinx8vZpLm+gcMBEgcIARABIJBgMhII5s79rcCI/IJ+EgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDIWCJiYntn49dXkggESCQgAEAEggICACHoCCACCAQIYAA==","saved_system_profile_hash":"1C7CAA303FB4F30A304BA4E68CF94DA878BD3A61","stats_buildtime":"1696412494","stats_version":"117.0.2045.55-64","system_crash_count":0},"unsent_log_metadata":{"initial_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0},"ongoing_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0}}},"variations_compressed_seed":"H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+
              Source: Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.0000000000FB2000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
              Source: jk98mGM6JH.exe, 00000000.00000003.2202873339.0000000006058000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ccount.microsoft.com/profileVMware20,11696487552u
              Source: jk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010A2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_di
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeSystem information queried: ModuleInformationJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess information queried: ProcessInformationJump to behavior

              Anti Debugging

              barindex
              Hides threads from debuggers
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebugger
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeThread information set: HideFromDebugger
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebugger
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeThread information set: HideFromDebugger
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeThread information set: HideFromDebugger
              Potentially malicious time measurement code found
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_050D0955 Start: 050D0B86 End: 050D09460_2_050D0955
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_05120729 Start: 05120B12 End: 051207590_2_05120729
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_05180BA9 Start: 05180CAE End: 05180BB80_2_05180BA9
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_04D70557 Start: 04D70C6F End: 04D7056810_2_04D70557
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_04D70000 Start: 04D70087 End: 04D7006110_2_04D70000
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_04D90D66 Start: 04D90E06 End: 04D90E5D10_2_04D90D66
              Tries to detect sandboxes and other dynamic analysis tools (window names)
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: regmonclass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: gbdyllo
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: procmon_window_class
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: ollydbg
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: filemonclass
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: NTICE
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: SICE
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: SIWVID
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_050A0BD4 rdtsc 0_2_050A0BD4
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_0062FA70 mov eax, dword ptr fs:[00000030h]0_2_0062FA70
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_00624AB0 mov eax, dword ptr fs:[00000030h]0_2_00624AB0
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 10_2_003A4AB0 mov eax, dword ptr fs:[00000030h]10_2_003A4AB0
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeProcess token adjusted: Debug
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeMemory allocated: page read and write | page guard

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Disables Windows Defender (deletes autostart)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe" Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe" Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe "C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe" Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
              Source: jk98mGM6JH.exe, 00000000.00000003.2522548719.0000000006A2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2805785713.00000000084B6000.00000004.00000020.00020000.00000000.sdmp, PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3533826611.0000000000CC2000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
              Source: jk98mGM6JH.exe, jk98mGM6JH.exe, 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 0000000A.00000002.3051572033.000000000065E000.00000040.00000001.01000000.00000005.sdmpBinary or memory string: @Program Manager
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeCode function: 0_2_006ECCDC GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,0_2_006ECCDC
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Disable Windows Defender notifications (registry)
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
              Disable Windows Defender real time protection (registry)
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\ExclusionsRegistry value created: Exclusions_Extensions 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableRoutinelyTakingAction 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{853BCFF5-355A-4137-B729-011A9504EFE0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRawWriteNotification 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableRoutinelyTakingAction 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\ExclusionsRegistry value created: Exclusions_Extensions 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7A9DF558-D1DA-4A98-9FEA-833CADC1CE86}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRawWriteNotification 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableRoutinelyTakingAction 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\ExclusionsRegistry value created: Exclusions_Extensions 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
              Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{58F3DD1F-6B96-4659-9F5C-C3B235BF6A97}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRawWriteNotification 1Jump to behavior
              Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\NotificationsRegistry value created: DisableNotifications 1
              Disables Windows Defender Tamper protection
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeRegistry value created: TamperProtection 0
              Exclude list of file types from scheduled, custom, and real-time scanning
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeRegistry value created: Exclusions_Extensions 1Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry value created: Exclusions_Extensions 1Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry value created: Exclusions_Extensions 1Jump to behavior
              Modifies Group Policy settings
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile written: C:\Windows\System32\GroupPolicy\GPT.INIJump to behavior
              Modifies windows update settings
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
              Source: C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

              Stealing of Sensitive Information

              barindex
              Yara detected RisePro Stealer
              Source: Yara matchFile source: 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2670860055.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: jk98mGM6JH.exe PID: 1832, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 3968, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 9716, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Cr6QVRpzwqhYjtnCxFSW.exe PID: 10132, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\2DNcPleZ9unxLWQic11TF6k.zip, type: DROPPED
              Found many strings related to Crypto-Wallets (likely being stolen)
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Jaxx\Local Storage
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
              Source: jk98mGM6JH.exe, 00000000.00000003.2206621281.0000000006038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
              Source: jk98mGM6JH.exe, 00000000.00000003.2208633321.0000000006040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
              Source: firefox.exe, 0000002A.00000003.2865926671.0000025D9DB81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: keysToRemoveB
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.jsonJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.jsonJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqliteJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqliteJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\formhistory.sqliteJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\signons.sqliteJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\logins.jsonJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\signons.sqliteJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENTJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\places.sqliteJump to behavior
              Tries to steal Mail credentials (via file / registry access)
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\jk98mGM6JH.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: Yara matchFile source: Process Memory Space: jk98mGM6JH.exe PID: 1832, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected RisePro Stealer
              Source: Yara matchFile source: 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2670860055.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: jk98mGM6JH.exe PID: 1832, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 3968, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 9716, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Cr6QVRpzwqhYjtnCxFSW.exe PID: 10132, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\2DNcPleZ9unxLWQic11TF6k.zip, type: DROPPED

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire Infrastructure1
              Drive-by Compromise              		2
              Command and Scripting Interpreter              		1
              DLL Side-Loading              		1
              DLL Side-Loading              		81
              Disable or Modify Tools              		1
              OS Credential Dumping              		1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Ingress Tool Transfer              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Scheduled Task/Job              		1
              Scheduled Task/Job              		2
              Bypass User Account Control              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory3
              File and Directory Discovery              		Remote Desktop Protocol2
              Data from Local System              		2
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAt1
              Registry Run Keys / Startup Folder              		1
              Extra Window Memory Injection              		3
              Obfuscated Files or Information              		Security Account Manager225
              System Information Discovery              		SMB/Windows Admin Shares1
              Email Collection              		SteganographyAutomated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook12
              Process Injection              		12
              Software Packing              		NTDS1
              Query Registry              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
              Scheduled Task/Job              		1
              DLL Side-Loading              		LSA Secrets741
              Security Software Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
              Registry Run Keys / Startup Folder              		2
              Bypass User Account Control              		Cached Domain Credentials271
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Extra Window Memory Injection              		DCSync3
              Process Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
              Masquerading              		Proc Filesystem1
              Application Window Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt271
              Virtualization/Sandbox Evasion              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
              Process Injection              		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1393148 Sample: jk98mGM6JH.exe Startdate: 15/02/2024 Architecture: WINDOWS Score: 100 112 Antivirus detection for URL or domain 2->112 114 Yara detected RisePro Stealer 2->114 116 Machine Learning detection for sample 2->116 118 2 other signatures 2->118 8 jk98mGM6JH.exe 11 122 2->8         started        13 MPGPH131.exe 10 13 2->13         started        15 MPGPH131.exe 10 109 2->15         started        17 6 other processes 2->17 process3 dnsIp4 94 185.215.113.46 WHOLESALECONNECTIONSNL Portugal 8->94 96 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->96 98 193.233.132.62 FREE-NET-ASFREEnetEU Russian Federation 8->98 70 C:\Users\user\...\zqdrYwv5fC6zkQ9Tresm.exe, PE32 8->70 dropped 72 C:\Users\user\...\b2H5rX9tWHjbJEBjMEvH.exe, PE32 8->72 dropped 74 C:\Users\user\...\PLO4plFr34jobsiEh08j.exe, PE32 8->74 dropped 76 11 other malicious files 8->76 dropped 134 Detected unpacking (changes PE section rights) 8->134 136 Binary is likely a compiled AutoIt script file 8->136 138 Tries to steal Mail credentials (via file / registry access) 8->138 158 8 other signatures 8->158 19 zqdrYwv5fC6zkQ9Tresm.exe 8->19         started        22 PLO4plFr34jobsiEh08j.exe 8->22         started        24 Cr6QVRpzwqhYjtnCxFSW.exe 8->24         started        36 2 other processes 8->36 140 Multi AV Scanner detection for dropped file 13->140 142 Machine Learning detection for dropped file 13->142 144 Disables Windows Defender (deletes autostart) 13->144 146 Tries to harvest and steal browser information (history, passwords, etc) 15->146 148 Exclude list of file types from scheduled, custom, and real-time scanning 15->148 150 Adds extensions / path to Windows Defender exclusion list (Registry) 15->150 152 Tries to detect sandboxes and other dynamic analysis tools (window names) 17->152 154 Tries to evade debugger and weak emulator (self modifying code) 17->154 156 Hides threads from debuggers 17->156 26 firefox.exe 17->26         started        30 msedge.exe 17->30         started        32 firefox.exe 17->32         started        34 firefox.exe 17->34         started        file5 signatures6 process7 dnsIp8 120 Detected unpacking (changes PE section rights) 19->120 122 Modifies windows update settings 19->122 124 Disables Windows Defender Tamper protection 19->124 132 5 other signatures 19->132 126 Binary is likely a compiled AutoIt script file 22->126 38 chrome.exe 22->38         started        41 chrome.exe 22->41         started        43 chrome.exe 22->43         started        53 10 other processes 22->53 128 Hides threads from debuggers 24->128 100 142.250.64.67 GOOGLEUS United States 26->100 102 142.251.40.138 GOOGLEUS United States 26->102 108 16 other IPs or domains 26->108 78 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 26->78 dropped 80 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 26->80 dropped 82 C:\Users\user\AppData\...\places.sqlite, SQLite 26->82 dropped 130 Found many strings related to Crypto-Wallets (likely being stolen) 26->130 45 firefox.exe 26->45         started        47 firefox.exe 26->47         started        104 13.107.21.200 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 30->104 106 13.107.21.239 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 30->106 110 30 other IPs or domains 30->110 49 conhost.exe 36->49         started        51 conhost.exe 36->51         started        file9 signatures10 process11 dnsIp12 84 192.168.2.6 unknown unknown 38->84 86 239.255.255.250 unknown Reserved 38->86 55 chrome.exe 38->55         started        58 chrome.exe 41->58         started        60 chrome.exe 43->60         started        62 chrome.exe 53->62         started        64 msedge.exe 53->64         started        66 msedge.exe 53->66         started        68 msedge.exe 53->68         started        process13 dnsIp14 88 13.107.42.14 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 55->88 90 144.2.9.1 LINKEDINUS Netherlands 55->90 92 33 other IPs or domains 55->92

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              jk98mGM6JH.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\ProgramData\MPGPH131\MPGPH131.exe100%Joe Sandbox ML
              C:\ProgramData\MPGPH131\MPGPH131.exe42%ReversingLabsWin32.Trojan.Zusy
              C:\Users\user\AppData\Local\RageMP131\RageMP131.exe42%ReversingLabsWin32.Trojan.Zusy
              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll (copy)0%ReversingLabs
              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://pki.goog/repository/00%URL Reputationsafe
              http://x1.c.lencr.org/00%URL Reputationsafe
              http://x1.i.lencr.org/00%URL Reputationsafe
              https://www.amazon.co.uk/0%URL Reputationsafe
              http://185.215.113.46/cost/fu.exe22jBF8100%Avira URL Cloudmalware
              http://185.215.113.46/cost/fu.exegerta100%Avira URL Cloudmalware
              http://ocsp.rootca1.amazontrust.com0:0%Avira URL Cloudsafe
              https://www.bbc.co.uk/0%Avira URL Cloudsafe
              http://185.215.113.46/cost/well.exeAppData100%Avira URL Cloudmalware
              http://185.215.113.46/cost/fu.exek100%Avira URL Cloudmalware
              http://127.0.0.1:0%Avira URL Cloudsafe
              https://accounts.google.comC:0%Avira URL Cloudsafe
              http://185.215.113.46/cost/well.exe100%Avira URL Cloudmalware
              http://185.215.113.46/cost/fu.exe100%Avira URL Cloudmalware
              https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-1520%Avira URL Cloudsafe
              http://crl.pki.goog/gsr1/gsr1.crl0;0%Avira URL Cloudsafe
              http://185.215.113.46/cost/fu.exen100%Avira URL Cloudmalware
              http://185.215.113.46/mine/plaza.exet100%Avira URL Cloudmalware
              https://www.youtube.com--attempting-deelevation0%Avira URL Cloudsafe
              http://mozilla.o0%Avira URL Cloudsafe
              https://www.youtube.comC:0%Avira URL Cloudsafe
              https://accounts.google.comxv0%Avira URL Cloudsafe
              http://185.215.113.46/cost/well.exenBuil6N100%Avira URL Cloudmalware
              http://13.46/cexe0%Avira URL Cloudsafe
              https://accounts.google.comeo0%Avira URL Cloudsafe
              http://pki.goog/gsr1/gsr1.crt020%Avira URL Cloudsafe
              http://185.215.113.46/mine/plaza.exe100%Avira URL Cloudmalware
              http://185.215.113.46/cost/niks.exed100%Avira URL Cloudmalware
              http://185.215.113.46/cost/ladas.exel100%Avira URL Cloudmalware
              http://185.215.113.46/cost/well.exe6100%Avira URL Cloudmalware
              http://185.215.113.46/cost/fu.exegertaA100%Avira URL Cloudmalware

              Domains and IPs

              Contacted Domains

              ⊘No contacted domains info

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1812329813&timestamp=1708035730584false
                		high

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://duckduckgo.com/chrome_newtabjk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://duckduckgo.com/ac/?q=jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://185.215.113.46/cost/fu.exe22jBF8RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmptrue
                    • Avira URL Cloud: malware
                    		unknown
                    https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://185.215.113.46/cost/fu.exekRageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%MPGPH131.exe, 0000000A.00000002.3120615821.0000000007226000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3000180526.0000025DA7482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2867490495.0000025D9D898000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2874737929.0000025D9C496000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2867490495.0000025D9D8BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2889197168.0000025D9CB31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2880089736.0000025DA284E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2862799593.0000025DA1087000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://json-schema.org/draft/2019-09/schema.firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.crCr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2668233517.00000000014A1000.00000040.00000001.01000000.0000000D.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000000.2348106157.0000000001743000.00000080.00000001.01000000.0000000D.sdmpfalse
                            		high
                            https://www.leboncoin.fr/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://mozilla.ofirefox.exe, 0000002A.00000003.2838482055.0000025DA704D000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://185.215.113.46/cost/well.exeAppDatajk98mGM6JH.exe, 00000000.00000002.2761057014.0000000006083000.00000004.00000020.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              https://t.me/riseproRageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://spocs.getpocket.com/spocsfirefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozillfirefox.exe, 0000002A.00000003.2575167409.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://t.me/risepro_botuZRageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.youtube.comfirefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2559294871.0000025D9D690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2578860426.0000025D9D690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2625854245.0000025D9D690000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2671231461.0000025D9D682000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2676333857.0000025D9D69E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2662734500.0000025D9D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://185.215.113.46/cost/fu.exegertaMPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmptrue
                                        • Avira URL Cloud: malware
                                        		unknown
                                        https://completion.amazon.com/search/complete?q=firefox.exe, 0000002A.00000003.2575885925.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://185.215.113.46/mine/plaza.exetMPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          https://identity.mozilla.com/ids/ecosystem_telemetryUfirefox.exe, 0000002A.00000003.2865926671.0000025D9DB5C000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://ipinfo.io/o?izMPGPH131.exe, 0000000A.00000002.3078808474.0000000000D10000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.amazon.com/exec/obidos/external-search/firefox.exe, 0000002A.00000003.2480242544.0000025D98800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2857684648.0000025DA12A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2961467272.0000025DA1156000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2489554800.0000025D94EBD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.msn.comfirefox.exe, 0000002A.00000003.2874498443.0000025D9C4A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://mitmdetection.services.mozilla.comfirefox.exe, 0000002A.00000003.2844586974.0000025DA6B7C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.youtube.com--attempting-deelevationfirefox.exe, 00000029.00000002.2400183079.000001CFAD7C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://github.com/mozilla-services/screenshotsfirefox.exe, 0000002A.00000003.2480242544.0000025D98800000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://json-schema.org/draft/2020-12/schema/=firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://185.215.113.46/cost/fu.exejk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2761057014.000000000605F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        https://www.amazon.com/firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2firefox.exe, 0000002A.00000003.2575167409.0000025D9D449000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://t.me/RiseProSUPPORTjk98mGM6JH.exe, 00000000.00000002.2670860055.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000071E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.linkedin.com/login_sPLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://ocsp.rootca1.amazontrust.com0:firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://pki.goog/repository/0firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://www.ecosia.org/newtab/jk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185729135.0000000006063000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185578857.0000000006063000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.youtube.com/firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2806719806.0000025D995D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.bbc.co.uk/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://127.0.0.1:firefox.exe, 0000002A.00000003.2855426882.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://www.youtube.com/s/desktop/bdb59273/jsbin/web-animations-next-lite.min.vflset/web-animations-firefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152firefox.exe, 0000002A.00000003.2668225406.0000025D95BC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2951582876.0000025D95B83000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://ipinfo.io/MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.000000000066B000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000767000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000773000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://mitmdetection.services.mozilla.com/firefox.exe, 0000002A.00000003.2868065030.0000025D9D7D3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://shavar.services.mozilla.com/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://185.215.113.46/cost/fu.exenjk98mGM6JH.exe, 00000000.00000002.2761057014.000000000605F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: malware
                                                                                		unknown
                                                                                https://accounts.google.comC:PLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3529684760.0000000000990000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2443870042.0000020FCB850000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://ipinfo.io:443/widget/demo/191.96.227.222jk98mGM6JH.exe, 00000000.00000002.2670860055.000000000105E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.0000000000773000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://spocs.getpocket.com/firefox.exe, 0000002A.00000003.2564308495.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2864530719.0000025DA0F18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2856459014.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2878599347.0000025DA2D57000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://185.215.113.46/cost/well.exeRageMP131.exe, 00000022.00000002.2657858021.00000000006B2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: malware
                                                                                    		unknown
                                                                                    https://www.iqiyi.com/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://crl.pki.goog/gsr1/gsr1.crl0;firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-firefox.exe, 0000002A.00000003.3017006577.0000025DA2EF0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://t.me/risepromRageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.youtube.comC:firefox.exe, 00000021.00000002.2386659460.000001716F390000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://t.me/risepro_botWCr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://youtube.com/https://www.youtube.com/youtube.comQMPGPH131.exe, 0000000A.00000003.2516733304.0000000005D10000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://www.youtube.com/eiMPGPH131.exe, 0000000A.00000002.3106488836.0000000006342000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://mozilla.org/MPL/2.0/.firefox.exe, 0000002A.00000003.2567909028.0000025DA1292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3001881155.0000025DA740B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2785555547.0000025D9827F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2982409537.0000025D98396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2877038248.0000025D99B1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2851446275.0000025DA3327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.3004996804.0000025DA7348000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2789678989.0000025D98B45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2790125806.0000025D98BF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2805681316.0000025D9889F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2836960295.0000025D983CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2616425023.0000025D988AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2784587168.0000025D98B34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2684449918.0000025D98282000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2805681316.0000025D988B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2755939146.0000025D9492F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2823879379.0000025D988B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2955573200.0000025D98BE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2857902611.0000025DA1285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2620749654.0000025DA117D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2670258020.0000025D9492F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://t.me/risepro_bot&jk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://accounts.google.com/YocMPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://x1.c.lencr.org/0firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://x1.i.lencr.org/0firefox.exe, 0000002A.00000003.2914161348.0000025D9CAF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2868987909.0000025D9D438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://www.youtube.com/s/desktop/bdb59273/jsbin/custom-elements-es5-adapter.vflset/cfirefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://accounts.google.comxvPLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000DA3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://13.46/cexeRageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		low
                                                                                                        https://json-schema.org/draft/2019-09/schemafirefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://ipinfo.io/widget/demo/191.96.227.222Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000071E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://apis.google.comfirefox.exe, 0000002A.00000003.3001881155.0000025DA7405000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://185.215.113.46/mine/plaza.exejk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000002.2761057014.0000000006083000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2588693585.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2586382834.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2514029667.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2582587481.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2591400353.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2603704872.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2571175674.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2605609465.0000000000E76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2551332362.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3078808474.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3121450909.00000000072D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3120713333.000000000724C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2512497916.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2567719088.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2574783511.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2561440707.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2536830785.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2536747684.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: malware
                                                                                                              		unknown
                                                                                                              https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2firefox.exe, 0000002A.00000003.2873842339.0000025D9CAFD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://185.215.113.46/cost/well.exe6jk98mGM6JH.exe, 00000000.00000002.2761057014.00000000060A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: malware
                                                                                                                		unknown
                                                                                                                https://www.google.com/images/branding/product/ico/googleg_lodp.icojk98mGM6JH.exe, 00000000.00000003.2182856234.0000000006048000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2189976218.0000000006075000.00000004.00000020.00020000.00000000.sdmp, jk98mGM6JH.exe, 00000000.00000003.2185089579.0000000006061000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2551384293.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2576867180.0000000005C46000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2553718200.0000000005D27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://accounts.google.comeoPLO4plFr34jobsiEh08j.exe, 0000000F.00000002.3535890992.0000000000D78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  https://contile.services.mozilla.com/v1/tilesfirefox.exe, 0000002A.00000003.2878280004.0000025DA2EB8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.amazon.co.uk/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/firefox.exe, 0000002A.00000003.2888666753.0000025D9CBED000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://screenshots.firefox.com/firefox.exe, 0000002A.00000003.2480764925.0000025D98A07000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://www.google.com/searchfirefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2961467272.0000025DA1156000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2482353490.0000025D98A4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2489554800.0000025D94EBD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://json-schema.org/draft-07/schema#-firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://pki.goog/gsr1/gsr1.crt02firefox.exe, 0000002A.00000003.2874737929.0000025D9C483000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            https://www.wykop.pl/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://twitter.com/firefox.exe, 0000002A.00000003.2569951826.0000025D9D793000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.youtube.com/s/desktop/bdb59273/jsbin/desktop_polymer.vflset/desktop_polymer.jsfirefox.exe, 0000002A.00000003.3000180526.0000025DA747D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://185.215.113.46/cost/ladas.exeljk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                  		unknown
                                                                                                                                  https://www.olx.pl/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://t.me/risepro_botCr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.000000000077E000.00000004.00000020.00020000.00000000.sdmp, Cr6QVRpzwqhYjtnCxFSW.exe, 00000028.00000002.2650610233.00000000007C7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://www.google.com/complete/searchfirefox.exe, 0000002A.00000003.2533774985.0000025DA11BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2540341700.0000025DA11DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://185.215.113.46/cost/well.exenBuil6NRageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                        		unknown
                                                                                                                                        https://getpocket.com/firefox/new_tab_learn_more/firefox.exe, 0000002A.00000003.2574299512.0000025DA1249000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://json-schema.org/draft/2019-09/schema./firefox.exe, 0000002A.00000003.2871233509.0000025D9CB97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://getpocket.com/recommendationsfirefox.exe, 0000002A.00000003.3013298836.0000025DA3316000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://ipinfo.io/widget/demo/191.96.227.222I$RageMP131.exe, 0000000D.00000002.2536747684.0000000000C2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.tsfirefox.exe, 0000002A.00000003.2620749654.0000025DA117D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2591997474.0000025DA116F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://185.215.113.46/cost/niks.exedRageMP131.exe, 00000022.00000002.2657858021.00000000006DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                  		unknown
                                                                                                                                                  https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.tsfirefox.exe, 0000002A.00000003.2620749654.0000025DA117D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000003.2591997474.0000025DA116F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://google.comfirefox.exe, 0000002A.00000003.2575167409.0000025D9D438000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://185.215.113.46/cost/fu.exegertaAjk98mGM6JH.exe, 00000000.00000002.2670860055.0000000001104000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.amazon.de/firefox.exe, 0000002A.00000003.2871233509.0000025D9CB46000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high

                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                        Public IPs

                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                        13.107.6.158
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        142.250.80.110
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        185.215.113.46
                                                                                                                                                        		unknownPortugal
                                                                                                                                                        		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                                                        172.253.63.84
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.40.202
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.117.237.239
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                        142.250.64.99
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        172.253.122.84
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        157.240.241.35
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                        142.250.81.238
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        162.159.61.3
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                        142.251.40.132
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        13.225.63.80
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                        142.250.80.1
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        23.40.179.37
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		16625AKAMAI-ASUSfalse
                                                                                                                                                        172.217.135.70
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        40.71.99.188
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        13.107.213.40
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        157.240.241.1
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                        204.79.197.239
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        34.120.208.123
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.35.174
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.65.234
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.65.170
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        23.199.65.193
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		16625AKAMAI-ASUSfalse
                                                                                                                                                        1.1.1.1
                                                                                                                                                        		unknownAustralia
                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                        142.250.176.214
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.117.121.53
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                        13.107.21.239
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        142.250.72.102
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        52.24.144.241
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                        142.250.80.74
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        172.253.62.84
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        144.2.9.1
                                                                                                                                                        		unknownNetherlands
                                                                                                                                                        		14413LINKEDINUSfalse
                                                                                                                                                        13.107.42.16
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        142.251.40.214
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        13.107.42.14
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        152.199.24.163
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                        142.251.40.138
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.80.78
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        239.255.255.250
                                                                                                                                                        		unknownReserved
                                                                                                                                                        		unknownunknownfalse
                                                                                                                                                        31.13.71.7
                                                                                                                                                        		unknownIreland
                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                        142.250.80.70
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.160.144.191
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		2686ATGS-MMD-ASUSfalse
                                                                                                                                                        142.250.72.110
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.65.202
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.41.4
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        172.253.115.84
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.80.46
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.117.186.192
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                        23.96.180.189
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        31.13.71.36
                                                                                                                                                        		unknownIreland
                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                        142.250.65.182
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        13.107.21.200
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                        152.195.19.97
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                        142.250.176.206
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.41.14
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.117.188.166
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                        142.251.32.100
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.40.194
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.40.195
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.65.214
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        172.64.41.3
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                        142.251.35.170
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.65.195
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.149.100.209
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		2686ATGS-MMD-ASUSfalse
                                                                                                                                                        34.107.243.93
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.40.234
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        193.233.132.62
                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                        		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                        142.250.80.54
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        34.107.221.82
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.81.227
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.64.67
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        152.199.5.152
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                        142.250.64.65
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        35.244.181.201
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.65.227
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.81.234
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        192.229.211.108
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                        142.251.40.161
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        172.217.135.9
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        13.226.34.86
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                        52.12.189.203
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                        142.250.176.195
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.176.194
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        74.125.155.169
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.31.84
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.251.35.163
                                                                                                                                                        		unknownUnited States
                                                                                                                                                        		15169GOOGLEUSfalse

                                                                                                                                                        Private

                                                                                                                                                        IP
                                                                                                                                                        192.168.2.6
                                                                                                                                                        127.0.0.1

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                        Analysis ID:1393148
                                                                                                                                                        Start date and time:2024-02-15 23:19:09 +01:00
                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 12m 14s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:full
                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                        Number of analysed new started processes analysed:53
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Sample name:jk98mGM6JH.exe
                                                                                                                                                        renamed because original name is a hash value
                                                                                                                                                        Original Sample Name:736549a437da8dacb4c1d31c33ba75b8.exe
                                                                                                                                                        Detection:MAL
                                                                                                                                                        Classification:mal100.troj.spyw.evad.winEXE@173/969@0/90
                                                                                                                                                        EGA Information:
                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                        HCA Information:
                                                                                                                                                        • Successful, ratio: 51%
                                                                                                                                                        • Number of executed functions: 64
                                                                                                                                                        • Number of non-executed functions: 0
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                        Warnings

                                                                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtReadFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                        • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                        • VT rate limit hit for: jk98mGM6JH.exe

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        TimeTypeDescription
                                                                                                                                                        23:20:06Task SchedulerRun new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                        23:20:06Task SchedulerRun new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                        23:20:06AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                        23:20:15AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                        23:20:32API Interceptor68x Sleep call for process: jk98mGM6JH.exe modified
                                                                                                                                                        23:21:03API Interceptor1748898x Sleep call for process: MPGPH131.exe modified
                                                                                                                                                        23:21:12API Interceptor1x Sleep call for process: firefox.exe modified

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                        13.107.6.158SxoBZ4iTXS.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                          5nFy7LOCpD.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                            file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                              SecuriteInfo.com.Win32.TrojanX-gen.7800.8466.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.29663.14829.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                  SecuriteInfo.com.Win32.TrojanX-gen.6370.3894.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    SecuriteInfo.com.Win32.TrojanX-gen.1905.22029.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                      pF4qvp3MTb.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                        acQQDjNOw8.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                          SecuriteInfo.com.Trojan.Siggen26.6766.1834.3852.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                            185.215.113.465ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/well.exe
                                                                                                                                                                            SecuriteInfo.com.Trojan.Siggen26.6766.4021.25295.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/well.exe
                                                                                                                                                                            SecuriteInfo.com.Trojan.Siggen26.6766.21437.6924.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/well.exe
                                                                                                                                                                            file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/well.exe
                                                                                                                                                                            1cfxwHmB63.exeGet hashmaliciousAmadey, LummaC Stealer, RedLine, RisePro Stealer, XmrigBrowse
                                                                                                                                                                            • 185.215.113.46/cost/fu.exe
                                                                                                                                                                            8vPg8GbGtV.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                            file.exeGet hashmaliciousAmadey, RedLine, RisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                            Bbd9GbGTz6.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, XmrigBrowse
                                                                                                                                                                            • 185.215.113.46/cost/fu.exe
                                                                                                                                                                            file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                            • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                            34.117.237.239SxoBZ4iTXS.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                              5ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                  5nFy7LOCpD.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                    vYuQWLyPe2.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                      file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                        BdShellExt.DLLGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          SecuriteInfo.com.Win32.TrojanX-gen.7800.8466.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                            SecuriteInfo.com.Win32.TrojanX-gen.6370.3894.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                              SecuriteInfo.com.Win32.TrojanX-gen.1905.22029.exeGet hashmaliciousAmadey, RisePro StealerBrowse

                                                                                                                                                                                                Domains

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                ASNs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                GOOGLE-AS-APGoogleAsiaPacificPteLtdSGSxoBZ4iTXS.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                5ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                erg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                erg.exeGet hashmaliciousTrap StealerBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                boletafacturaeletrocinacge.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                CLOUDFLARENETUSVoicemail_Ref-973542.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.21.52.170
                                                                                                                                                                                                4f Medoc.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 172.67.154.29
                                                                                                                                                                                                SxoBZ4iTXS.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 172.67.215.138
                                                                                                                                                                                                https://medium.com/gopenai/how-much-data-from-the-public-internet-is-used-for-training-llms-dff5bc5ebb02Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.18.37.101
                                                                                                                                                                                                5ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 1.1.1.1
                                                                                                                                                                                                https://blog.gopenai.com/how-much-data-from-the-public-internet-is-used-for-training-llms-dff5bc5ebb02?gi=0984607645d1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.18.37.101
                                                                                                                                                                                                erg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.137.232
                                                                                                                                                                                                erg.exeGet hashmaliciousTrap StealerBrowse
                                                                                                                                                                                                • 162.159.138.232
                                                                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSSxoBZ4iTXS.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 20.75.60.91
                                                                                                                                                                                                https://monitor.clickcease.com//tracker/tracker?id=ep2024sVIUFIqUrNt34&adpos=&nw=a&url=//otiunmonisky2m.com/?utm_content=dQPuybqXiH&session_id=gLwochtTuiIHD7q8Saml&id=qiCEG&filter=tlJLHfOfsS-zalXI&lang=fr&locale=FRGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 20.234.104.33
                                                                                                                                                                                                5ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 13.107.9.158
                                                                                                                                                                                                https://monitor.clickcease.com//tracker/tracker?id=nj2024tVUEFIqArNt03&adpos=&nw=a&url=//otiunmonisky2m.com/?utm_content=vrsuSQtFMv&session_id=BPJNEM1vCwKeJERcuV8s&id=24L79&filter=CbXawfHONB-KdARv&lang=en&locale=GBGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 20.234.104.33
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 13.107.9.158
                                                                                                                                                                                                https://www.trucknews.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 13.107.42.14
                                                                                                                                                                                                Doc Copy - Lingo Construction Services Inc. - RNP58382637F255-1.msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                rInquiry__Orderlist.batGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                                                                                                                                • 150.171.43.11
                                                                                                                                                                                                ETJ.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 13.89.179.11
                                                                                                                                                                                                ji5zq1gsV7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 20.183.203.90
                                                                                                                                                                                                WHOLESALECONNECTIONSNLSxoBZ4iTXS.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                5ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                com.javxvvpaj.yjpowlihgj.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 185.215.113.31
                                                                                                                                                                                                5nFy7LOCpD.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                vYuQWLyPe2.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                xPcfYU46r0.exeGet hashmaliciousAmadeyBrowse
                                                                                                                                                                                                • 185.215.113.32
                                                                                                                                                                                                FV0mIIfKwQ.exeGet hashmaliciousAmadey, RisePro Stealer, SmokeLoader, StealcBrowse
                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.7800.8466.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                • 185.215.113.46

                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                C:\ProgramData\MPGPH131\MPGPH131.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2393600
                                                                                                                                                                                                Entropy (8bit):7.933479637135835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:bnzYkijkaP8vRxUoDuBivcf9hKzs3YRHj6hzfaybLaXhjjv8Eb0ybBpa:bnQj2PUoD50Kyl9bLaXN86ZO
                                                                                                                                                                                                MD5:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                SHA1:7EB5E89620F4A6DE369A9667133CB2EF01D27ED3
                                                                                                                                                                                                SHA-256:6FC1848EA0691845F977875FF74A353CBAE23C75011C427720EC37659784860F
                                                                                                                                                                                                SHA-512:ADA7DCD0EB06696AE6792F7D50CA10165CC55532D31C71F2A7A19B60876E826EC22D4C3604833FF19A36DFF8CAA14AC8BB6BF4372BAFC3A6602BE9849A84E09E
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 42%
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....,........[...........@...........................[.......$...@.................................T...h....p.............................................................................................................. . .`..........................@....rsrc........p... ..................@....idata ............. ..............@... ..+.........."..............@...idnrjgyt.@...p@..:...$..............@...ssvxgfuk......[......^$.............@....taggant.0....[.."...d$.............@...........................................................................................................................................................................................

                                                                                                                                                                                                C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):26
                                                                                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_77e05644-1077-4a09-8f4f-d11661514336.json (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):7632
                                                                                                                                                                                                Entropy (8bit):5.164116234326732
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:CBMiJl+cbhbVbTbfbRbObtbyEl7nBJA6unSrDtTZdxSofa:CiLcNhnzFSJc1nSrDhZdx+
                                                                                                                                                                                                MD5:41FE97E13BFB9B86CF409BB7B4D8AB2C
                                                                                                                                                                                                SHA1:6D38732F17FB747703B7033F882B6E613215793A
                                                                                                                                                                                                SHA-256:60816A110724BFBBCCB8E87D3E886B8D262304DB5CEF0EB2B188879B97D98810
                                                                                                                                                                                                SHA-512:07548CCE54C6E6DD2D6FBEE80F7B8F384650830C278695C93CCD4341CB5852BB07A2CD9901DEFDF772EEF91F750A6B33FD939F2F279906F2E4CD054CDB71F7BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"type":"uninstall","id":"77e05644-1077-4a09-8f4f-d11661514336","creationDate":"2024-02-15T23:35:04.505Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_77e05644-1077-4a09-8f4f-d11661514336.json.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):7632
                                                                                                                                                                                                Entropy (8bit):5.164116234326732
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:CBMiJl+cbhbVbTbfbRbObtbyEl7nBJA6unSrDtTZdxSofa:CiLcNhnzFSJc1nSrDhZdx+
                                                                                                                                                                                                MD5:41FE97E13BFB9B86CF409BB7B4D8AB2C
                                                                                                                                                                                                SHA1:6D38732F17FB747703B7033F882B6E613215793A
                                                                                                                                                                                                SHA-256:60816A110724BFBBCCB8E87D3E886B8D262304DB5CEF0EB2B188879B97D98810
                                                                                                                                                                                                SHA-512:07548CCE54C6E6DD2D6FBEE80F7B8F384650830C278695C93CCD4341CB5852BB07A2CD9901DEFDF772EEF91F750A6B33FD939F2F279906F2E4CD054CDB71F7BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"type":"uninstall","id":"77e05644-1077-4a09-8f4f-d11661514336","creationDate":"2024-02-15T23:35:04.505Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zqdrYwv5fC6zkQ9Tresm.exe.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe
                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):226
                                                                                                                                                                                                Entropy (8bit):5.360398796477698
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
                                                                                                                                                                                                MD5:3A8957C6382192B71471BD14359D0B12
                                                                                                                                                                                                SHA1:71B96C965B65A051E7E7D10F61BEBD8CCBB88587
                                                                                                                                                                                                SHA-256:282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
                                                                                                                                                                                                SHA-512:76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0aa007b7-8092-4a57-89c4-0f023222ae4f.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45881
                                                                                                                                                                                                Entropy (8bit):6.092936984973044
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:LDXzgWPsj/qlGJqIY8GB49KX6wi1zNtd450QE69kDzFmjyAKJDSgzMMd6qD47u3/:L/Ps+wsI7yAKC4bEKKtSmd6qE7lFov
                                                                                                                                                                                                MD5:4FE244A0AA027C62A591872C23D5F358
                                                                                                                                                                                                SHA1:98B2589C36C7B9F208553D2F07FB34878DB0D5F0
                                                                                                                                                                                                SHA-256:EA44B404D8DED66A4E5FB577F90B009901B9BBDCC95075A33CCCA2763F56CD3C
                                                                                                                                                                                                SHA-512:513083D1D99D6533CB450A4006D307EDEC70557FCBEFDF306AC9858FDF042A4A5C9450AAEFD86998915A9199B25A0C2F8D01188A78EDE646B1ED2E52058477EF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"EAD2F7F304438EAE4EE2A4A824C7D0ADEE7DD839BDE627B460B259EDF643904C\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f85cc37-0a78-40aa-85a4-99ce8f7cb6f6.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):44040
                                                                                                                                                                                                Entropy (8bit):6.094761888550973
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWIEi1zNt/TXNQk+KJDSgzMMd6qD47u3+CioVf:+/Ps+wsI7ynZXGKtSmd6qE7lFoV
                                                                                                                                                                                                MD5:2885D00079C25603C6225521AC1FFC7F
                                                                                                                                                                                                SHA1:4BC044B210781FDC1A03B3F43B65882B6F90A3E3
                                                                                                                                                                                                SHA-256:B5AB59B79A3B1849498295159B3A084BD1FBB40486B68DD40266CA8B3C232CE7
                                                                                                                                                                                                SHA-512:2ECED11A447F8B10F3D4EB983D9032A4DF29FCCF708CA14CF341BE46B8A657331A8DA72A221438C1D1B74F1BC3405FEA9304E34CD7860A920FE54C5ABD6D0A6C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\17b84ad9-5077-4d77-8b73-609761e025e3.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45881
                                                                                                                                                                                                Entropy (8bit):6.09293377530772
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:LDXzgWPsj/qlGJqIY8GB49KX9Mbi1zNtd450QE69kDzFmjyAKJDSgzMMd6qD47uv:L/Ps+wsI7yAKj4bEKKtSmd6qE7lFov
                                                                                                                                                                                                MD5:2DFF5BAF72E3605D622A794B690F1FF4
                                                                                                                                                                                                SHA1:D1DCC79B43673BEF1449A2B01DE3E69D890200C1
                                                                                                                                                                                                SHA-256:7643F5D783F6105946E26F7655A8CE4A93F11CB9B1FC72E0C719228C55EFB036
                                                                                                                                                                                                SHA-512:05C0D200C61121F845ADD17470C01B39B3973F0CA0F076D7B3778A4AA27C05FB59489D5AECB6DA31555A0217D568BFECC456CF86FA7581C45C0B103D65693D6F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"EAD2F7F304438EAE4EE2A4A824C7D0ADEE7DD839BDE627B460B259EDF643904C\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30e3f6c4-44a0-4ec0-9411-e0b07d1ddde6.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3a59baf1-7556-479c-bcbe-43cc6a619d22.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45881
                                                                                                                                                                                                Entropy (8bit):6.092932826129933
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:LDXzgWPsj/qlGJqIY8GB49KX9Mbi1zNtd450QE99kDzFmjyAKJDSgzMMd6qD47uv:L/Ps+wsI7yAKj4bEFKtSmd6qE7lFov
                                                                                                                                                                                                MD5:A80950B097AF5D74F39E31A9DB55BADE
                                                                                                                                                                                                SHA1:C764CC3401146CD46E539B752FAE026A4CA99DA9
                                                                                                                                                                                                SHA-256:A5281FB5041AB5E5C9E1AFDB2FD3F5B5AC58C2B28A029B8B3AFCBCE9E51A01EE
                                                                                                                                                                                                SHA-512:FDD213BE5E5FE9083FD83DEDCFB5844D6719EAE4A8F268D0BF5ADECC7A946981221055246D142C670E05EE78F4542AA657D164C685C083A5FEC43C3C0CE57FC6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"EAD2F7F304438EAE4EE2A4A824C7D0ADEE7DD839BDE627B460B259EDF643904C\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\55ea9ca6-7246-4be4-a9d2-d489a0660aeb.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45804
                                                                                                                                                                                                Entropy (8bit):6.0928889084150075
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:GDXzgWPsj/qlGJqIY8GB4xKXs8i1zNtd450QE99kDzFmjyAKJDSgzMMd6qD47u3/:G/Ps+wsI7yOKA4bEFKtSmd6qE7lFov
                                                                                                                                                                                                MD5:028183A09B7A6DC31B9838D13A815C04
                                                                                                                                                                                                SHA1:1344E4A556CE1EA4F2782A7AF3785A2E575687F7
                                                                                                                                                                                                SHA-256:AE46A0EA5B5D9A3F6D348FF671CDCB2B05105664013D509C6CC094201935451A
                                                                                                                                                                                                SHA-512:02F01CCC97B801C3E0A3A4DEE2C49BE9D84055BDE292BE6B0C04084586773CA2707441C665591650FEC98C9EA04E8E8C820960453DDF3EF0F5FC4FA54C09E512
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6d72f63e-150a-4a9c-834b-3fda155781ea.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45804
                                                                                                                                                                                                Entropy (8bit):6.092884393477295
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:GDXzgWPsj/qlGJqIY8GB4xKms8i1zNtd450QE99kDzFmjyAKJDSgzMMd6qD47u3/:G/Ps+wsI7yOKL4bEFKtSmd6qE7lFov
                                                                                                                                                                                                MD5:FAD586B2FDA58994E7A93A5E2D0A1AB7
                                                                                                                                                                                                SHA1:8667C8050E4FD916093ECF20DCA9CCF472E3DCA3
                                                                                                                                                                                                SHA-256:AE50AE54465E3989CBD3F9DE8CF19065F2C0864B7E161DCFF4797A250460727F
                                                                                                                                                                                                SHA-512:42FFAFEBF4D7DE8EEB97D9205052AAE5CE731CBFF24706818C320FFA5E0599960625719C24148D7419756645F4DE86F7DC943D8B68CCD55C6469B9F78AC9968F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\77dcb9f2-2e6f-4033-bb71-1421d0bef918.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44898
                                                                                                                                                                                                Entropy (8bit):6.09589555490867
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWPpi1zNtd450QENzkMEDDLl2KJDSgzMMd6qD47u3+7:+/Ps+wsI7ynn4bEFKtSmd6qE7lFoC
                                                                                                                                                                                                MD5:3665F747F62B4D9482577979E8C4BC85
                                                                                                                                                                                                SHA1:ACB408886BFA26D89E62A83DC66B8EE2B3A5CD21
                                                                                                                                                                                                SHA-256:C00FEA528B7BE4F7F33C9626B414D4A827DD938276492470E7839467320EF262
                                                                                                                                                                                                SHA-512:79B77F291289FF5F8D4435D473C2847B2E5B4B01989B7350DA216E313D1D6034A809EBD16E8D7C662E1CCC89A9338A55CCE87AF30CD6103E1CF513758C187E0F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9d6f86a3-582a-428f-ba3e-eab84fbce401.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44381
                                                                                                                                                                                                Entropy (8bit):6.089488974701252
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWsdi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioV:+/Ps+wsI7ynsokzItSmd6qE7lFoV
                                                                                                                                                                                                MD5:F92E5C46D9CD1F8EFCEC9E72ABC22DD0
                                                                                                                                                                                                SHA1:3C183FC4EA753AD0284F852CFA33885F682C0CC5
                                                                                                                                                                                                SHA-256:5888D6176A4C7323D827B03F062F538357A0330057B5C380055CABE24E6E319F
                                                                                                                                                                                                SHA-512:B03885C03FB7829F7B2751AF3BDF3DB5EAB4BFEC732A3B2A1E7AA0F4AAD13F07C0926E30F057ABAB4581F65579943AF7F410DE83D6160573EC143BC5AE06A488
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                                SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                                SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                                SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65CE8E27-2268.pma

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                Entropy (8bit):0.047392008631810485
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:6n8a0pqtmunOAtZYCWJPi6VBKP7+G1gsXpKIe5EvjBzhc5NDqf21gQ9KSVUGOjns:68a0ctFpWMqN6hMCSgQUB08T2RGOD
                                                                                                                                                                                                MD5:01B5E367C242BFFE6128A7FD3298CD53
                                                                                                                                                                                                SHA1:8E39A37EE482E734278AC4F7856A946B1AAAAC42
                                                                                                                                                                                                SHA-256:0D0FF6D5C72B8671A747751A02BC799C96DEA33A3A83C754CC945BC072E4C9FF
                                                                                                                                                                                                SHA-512:8B57D1169B9A2BB0A8E14B9E7E387ADAF519C3310A45D6E6AF7D5EDAE833982F7F074ACC4170BDF72F14F98C73036E646E7345B412D931509C7FBCDCFB8FACC6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...@..@...@.....C.].....@................j..PZ..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".gmxaui20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2............... .2.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65CE8E27-2364.pma

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                Entropy (8bit):0.04085931892094119
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:elx0o3tmP6raZpFJXCqltLuLyTfDVg8Xw1cEI6T/hcVcNcno1gQs0Y/i0n8y08TQ:eX0stsFxaGKQohnYAgwY6008T2RGOD
                                                                                                                                                                                                MD5:33A46BEA8878828BB3AFB297B9702480
                                                                                                                                                                                                SHA1:8F36217356F4D863552CADEB8AE29A6BADC747CC
                                                                                                                                                                                                SHA-256:5E3ACA529C72CD1D7355FBDA2231875A4778F9E3EB49168824A2AFF678581967
                                                                                                                                                                                                SHA-512:485456807383CC1696A6046E69FA93E3A1EBA720C81181D811A50F2006D5C126826D6CF3CC66ECADFFA6529A3BC73794CCBE9858A0B68CA7F6276FDBEFA4B9B1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...@..@...@.....C.].....@...............xb..0R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e..........117.0.2045.55-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".gmxaui20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U.>.........."....."...2...".*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65CE8E29-2630.pma

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                Entropy (8bit):0.4994037210211742
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:4mH/jJbG2eh7aHK2QyCAnaH5pQC9bv1OYi:/ehG6TZR
                                                                                                                                                                                                MD5:69242E0EF1919D578247BD723D9B42CE
                                                                                                                                                                                                SHA1:71F1BCE6CBB555FDEF17DADAA52C72DD20B0273C
                                                                                                                                                                                                SHA-256:AA71B1B8B1DFFA1D1AA221467E8A5AD2528C1C20DDE20287CA7C238A318AE834
                                                                                                                                                                                                SHA-512:C6F9672ADFC964330EA36E280FBF434FE0243733736A888C0093D6063D7A9690F134916F32CAFC8C19648EA7714B0340F985A61C5D8AC91E972E1284A0FAC1AD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...@..@...@.....C.].....@...............@...x...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".gmxaui20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K..>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2..........I....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):280
                                                                                                                                                                                                Entropy (8bit):4.0984945491284295
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
                                                                                                                                                                                                MD5:AFAC5E4CC1213807ACB7D1A0F61BCF99
                                                                                                                                                                                                SHA1:FEDCA0A829A0DBCCD1E9D7048398372FF9604783
                                                                                                                                                                                                SHA-256:FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
                                                                                                                                                                                                SHA-512:44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\33d29241-4fea-455a-9f64-7a9f47f631cc.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:L:L
                                                                                                                                                                                                MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\368b53ef-9761-470f-a038-35b3c02877ac.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6123b2f3-32cd-487e-b78c-59096d62b08b.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):14250
                                                                                                                                                                                                Entropy (8bit):5.2293935544979915
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttJ99QTryDiooSabatSuyhsvbaFvrE9kkN3r8JbV+FCZ7/7NpwaqU2PHjJ:sttPGoZSu+svbCDDbGCFTHwiC
                                                                                                                                                                                                MD5:F02843DA5FCA2E46E2C6733711E0A019
                                                                                                                                                                                                SHA1:ECE9CE767B73286518216570B178B57B5F9B2877
                                                                                                                                                                                                SHA-256:1912958829BB6DA9FDCD5EA1D80EDD279789CF88627DC2D7EA13291A028B65A4
                                                                                                                                                                                                SHA-512:6BA901B57AB6D7C793BC7270E4CB1CEA2BCA8F84D9D260904FD1AF1D12647506D76C2C2A3FB499AB65958BEFD8287C7822A09F3053BDFE900896391F9E63CED7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\697d305b-32bc-4154-b379-e6fb67b79361.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12516
                                                                                                                                                                                                Entropy (8bit):5.205460928431958
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttJ99QTryDi6oSabatSuyhsvbaFvrE9kjN3r8WbV+F5UQaAU2PHYJ:sttPG6ZSu+svbCDHbGyQ+D
                                                                                                                                                                                                MD5:C43FCCE49C886264A12027705BC596F7
                                                                                                                                                                                                SHA1:D900B2BE614775C64F29192E105BC6EC1F67B9D3
                                                                                                                                                                                                SHA-256:31A80E9A402CF395DDB4F68535A8E547F39918F220100CB6E4621F8455FC6E47
                                                                                                                                                                                                SHA-512:8E494E1CE094FF9D413EC29E5057912BB81AB993E8AAA964459DF0720FE81C5F4C984AC65521F2274221E9693C50124D6CD3432EE1AEFBA0B8BD992278C9CD7A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\776d6239-7a56-467e-8c83-56cc86bb673d.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9685
                                                                                                                                                                                                Entropy (8bit):5.111886637797394
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaKU2PHYJ:sttWsvbCDHbGyQkD
                                                                                                                                                                                                MD5:C8003A1651EB8A0E9DC10ACB778885A1
                                                                                                                                                                                                SHA1:A3BA24E7E6BBA64CEAC92A2DB925F61561897EB3
                                                                                                                                                                                                SHA-256:4D5624262DBAD59A3CD91241A4F5714730D1BA9296383509B2D19D1AF89B9838
                                                                                                                                                                                                SHA-512:13E8D611AF243A3A0BCF3D24BBEBB1D5FA4F14CCDC6F09D61E7AF640DF4B70528B5955CCB3543DD373865533AFE49006AAA270DD86DBAF6E55D81780145930EB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8551a424-bd5d-4572-a4c6-33b614afed6d.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):115717
                                                                                                                                                                                                Entropy (8bit):5.183660917461099
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                                                MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                                                SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                                                SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                                                SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8e280ec7-094a-4f9f-a3f8-27235d4b537e.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):14250
                                                                                                                                                                                                Entropy (8bit):5.2293935544979915
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttJ99QTryDiooSabatSuyhsvbaFvrE9kkN3r8JbV+FCZ7/7NpwaqU2PHjJ:sttPGoZSu+svbCDDbGCFTHwiC
                                                                                                                                                                                                MD5:F02843DA5FCA2E46E2C6733711E0A019
                                                                                                                                                                                                SHA1:ECE9CE767B73286518216570B178B57B5F9B2877
                                                                                                                                                                                                SHA-256:1912958829BB6DA9FDCD5EA1D80EDD279789CF88627DC2D7EA13291A028B65A4
                                                                                                                                                                                                SHA-512:6BA901B57AB6D7C793BC7270E4CB1CEA2BCA8F84D9D260904FD1AF1D12647506D76C2C2A3FB499AB65958BEFD8287C7822A09F3053BDFE900896391F9E63CED7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):313
                                                                                                                                                                                                Entropy (8bit):5.263280596515657
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXC43+q1N723oH+Tcwtp3hBtB2KLlgGfXC4dB+q2PN723oH+Tcwtp3hBWsIFUv:a143+aaYebp3dFLC14dMvVaYebp3eFUv
                                                                                                                                                                                                MD5:BFB09E6719ACF2804A7F737A0574B9F2
                                                                                                                                                                                                SHA1:A88E9E11A4C8FFB0C3672FDA8D9AA85937939A79
                                                                                                                                                                                                SHA-256:14B9F8874EBDCA1A731E3F66C121E4DDDE8633FDCB764A365139A39CE8A8825C
                                                                                                                                                                                                SHA-512:24206E22A2636CED89E690E6A92309251609395D8E8AD07E5DF152631868358DE289A5A5B98205F91D04E5E1247F0A389C666397D6940B13511814A004A4C96D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:21:07.752 1c88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/02/15-23:21:07.893 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):41
                                                                                                                                                                                                Entropy (8bit):4.704993772857998
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2164095
                                                                                                                                                                                                Entropy (8bit):5.2231805521130665
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:IbPMZpVdf0W1XguC5hrslmn+AypENU8ikYSbQbR2z:IbkZpVdfBbmbd
                                                                                                                                                                                                MD5:5D7DEEBF1875F9083CA9B483ED59B188
                                                                                                                                                                                                SHA1:1AEFA1E28857F06809E767ABEBA56608ABEF98AD
                                                                                                                                                                                                SHA-256:7F85E517EF5F1D0735D6110120BE1CCAB5C96C470CD030C1F209DFDD120C84B6
                                                                                                                                                                                                SHA-512:3BC6831151252E6E6382CACB1632E66419568F3C31AFC7E01CCB418B8E1A929F45613B6061E6402D6B19AB6FE7564392B808A7D6E354E7CC47E7E00C90AC3167
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13340960289901340.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):340
                                                                                                                                                                                                Entropy (8bit):5.072511591441081
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXd1Vq2PN723oH+Tcwt9Eh1tIFUt8XGfXAX5VXZmw+XGfXOkwON723oH+TcwtY:aafvVaYeb9Eh16FUt8Xv5VX/+Xz5OaYf
                                                                                                                                                                                                MD5:8B57520629AFEAFA362BD7DDFC2ECEBF
                                                                                                                                                                                                SHA1:F18A7AC62585F36C3FAECFC7CEB643C276A552CC
                                                                                                                                                                                                SHA-256:33CA5898152CB56C412461C1154A9A9CB3020011357C9C0226EA8E7C909E1EBE
                                                                                                                                                                                                SHA-512:AAE73807E61EF392F4EB81A03377530EA8B54272612C88F6FC191CAD72920CE998B7D80097C4BE3D4CF904606EC63F8DA3FEE760F310DAD2A3DD73C24D08BBEB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:54.527 2e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/02/15-23:20:54.732 2e90 Recovering log #3.2024/02/15-23:20:56.202 2e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):340
                                                                                                                                                                                                Entropy (8bit):5.072511591441081
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXd1Vq2PN723oH+Tcwt9Eh1tIFUt8XGfXAX5VXZmw+XGfXOkwON723oH+TcwtY:aafvVaYeb9Eh16FUt8Xv5VX/+Xz5OaYf
                                                                                                                                                                                                MD5:8B57520629AFEAFA362BD7DDFC2ECEBF
                                                                                                                                                                                                SHA1:F18A7AC62585F36C3FAECFC7CEB643C276A552CC
                                                                                                                                                                                                SHA-256:33CA5898152CB56C412461C1154A9A9CB3020011357C9C0226EA8E7C909E1EBE
                                                                                                                                                                                                SHA-512:AAE73807E61EF392F4EB81A03377530EA8B54272612C88F6FC191CAD72920CE998B7D80097C4BE3D4CF904606EC63F8DA3FEE760F310DAD2A3DD73C24D08BBEB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:54.527 2e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/02/15-23:20:54.732 2e90 Recovering log #3.2024/02/15-23:20:56.202 2e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                Entropy (8bit):0.45733741907391595
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwjfBjzUSL+JD:TouQq3qh7z3bY2LNW9WMcU4Bjz9L+J
                                                                                                                                                                                                MD5:AD08C4B6B9FA85708623F1682AAFA07D
                                                                                                                                                                                                SHA1:FBA9AECF19FD76312C0C5FB6D434833D59527961
                                                                                                                                                                                                SHA-256:00E1B563D0C827B392DA1E14030D49BD64BC95CA84539CD52772A0772A577055
                                                                                                                                                                                                SHA-512:9F729AB6E79911FAD1F9FE2BEA1628CEBAB13E03A91117CF39D08D6880E7AF10C268C3432610F8A47065F75DB7EB042A33A0E26B4441983B0C7D687998727C40
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):783646
                                                                                                                                                                                                Entropy (8bit):5.992211832761582
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:jRE1WUgwN/I1bkwDUrCgTKo95GyMcixxmOE9TkoGfDSfjpnFs4wOAjPNEDQSGXeJ:VCgRXDUrCy55MVxxm1TkKf9KhJP+DQen
                                                                                                                                                                                                MD5:036C1B65637366FDD6F52B152FAEEE80
                                                                                                                                                                                                SHA1:13EEDEFB608A517A40AF0290738D15E2E8C640EE
                                                                                                                                                                                                SHA-256:5FF361BC47FEF559BDAEE81F0000CA5C686C07D666EBDB41316ADD99DFD43D81
                                                                                                                                                                                                SHA-512:6819A62316493F54C39C7B48D671A69C4FD6659F2F4F8EB5CD26EAB6FBE26B5D7BFBECA57445F55D2B3863656A786612A2929AC21A0A097A94AC0DC8AFADD6A4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...m.................DB_VERSION.1I....................BLOOM_FILTER:../{"numberOfHashFunctions":8,"shiftBase":9,"bloomFilterArraySize":4650332,"primeBases":[5381,5381,5381,5381],"supportedDomains":"sXqgLAGjEMYcyKoT8nU3mKIS8AT7AaB9s/Cl7NSXDim0IqBOyWBIEiwm0CbyE+mgdgSgV7E5E/hd7d1CcQDmuMqwZdJo6Qgy8KZE3PDR9TkJl3jHKUAwF08DG/ai+qeCKVJq9Nu2PJLb5Jnv/I7y5eMWZMB8jSbC1pBQ/rhlWMqet4DRXyQ5qG1kO7/n/290mZTiMZuZ55nX1Ghe1aqKtMcGBsTZB42GTKpEZfpGqKiVz32DsEoJQID28idCK8kMsGzUY4ouFk/cGvq+vBMNiPAzLjlYW2k/NjUM1BXzLEQWUcsrVCBb+x7u5Jvj0SIp4FIEBok1fSl+Ch4JA05MeNcN44fHjepTEeybAWCMItICMoAoicQCdDu4+/8eUGpoSUkCCF4CUpouwhIAJUJa+FJ8hy1MUAFCUCsCX7b/OrYOf3IopeuRQvCsqPX507lwK3q8qZlwmAKHeMYVidzdgDRlm1oC+a9JCtwzoMAAaRhouTeK4RTRxiepqQTIJ0sBgAUI8NiN4NVneurGbs8BXTMK8ocGIKc6i5UY0rKEiJhDVWLgIcCEQr1sF6akD1+tWkOkE6McwI+GgjZQi6kruvb6+UJsl3Ytlg1AnVNCnAwoNJkkGjHVEh5wXi1M0bd3em66+y+zmySf7ogDSOYJJbyhTydFDLwv6+nT4mE3JgopL/q3Bgt2iTPho2RAVUqIbjqnBiFYhBUDdUoJR5VSBEyCDl7d1sqMM947ndDv/pJDrsABYy3ARBUAEfaKjjwsAyweR4SWqpkkAhGok3gPc8TkpautAwh0sIw

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):142
                                                                                                                                                                                                Entropy (8bit):4.992467094948838
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:xpYlt38E28xp4m3rscUSVdOrTnKSdJtlf+nETPxpK2x7L8KFJ4t9oss:wlt38D8xSEsIVdCKSj+n0PxEWHFw9oss
                                                                                                                                                                                                MD5:70C86FE2AE90ED132C76DA502167EC32
                                                                                                                                                                                                SHA1:63016E554385777CDAE92C1ED7CC242AC8D5E4D6
                                                                                                                                                                                                SHA-256:3DF41D7C8B27A6B4058A94D19FB4C21E2EFEA436D40037BFD44486DFF5F46193
                                                                                                                                                                                                SHA-512:B13C07FE47FFCD93AEC1B975D2DC563BEF058EE7346ADBDE4A0F4595061632366A1B0C2BD84A8B9E98E28B85B8F602E8CABDFB05E296D2D165FDCBCAA1293250
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..L.9................BLOOM_FILTER_EXPIRY_TIME:.1708122046.665020.V.G................BLOOM_FILTER_LAST_MODIFIED:.Thu, 15 Feb 2024 16:46:28 GMT

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):783593
                                                                                                                                                                                                Entropy (8bit):5.991469380220247
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:iRa1WMgwNZI1baiDUrCggtO95GyMcixomOE9TioGfD0hjmnFl4wOUj9NEDDYGXej:UEgV9DUrC655MVxom1TichS7hT9+DDd+
                                                                                                                                                                                                MD5:6CFC6B4B7039D67BAA7B437B6E0CFBBF
                                                                                                                                                                                                SHA1:D0C1925038463E4D1D102B96FCC2DE8E7ED4C712
                                                                                                                                                                                                SHA-256:6F0C74C40B13F589B2EAD7BB68B67523337AFAD637B81E617FBA2BDADC3F6F83
                                                                                                                                                                                                SHA-512:75DA563C621EA495EA0B39F66F9F1FFF6EC81DEBA9A85E74E8B38EA22F57845C4AE5625C2567DE15ADE2F144FCDABDD013113C39A21AC952C715E3DB5A66EBEE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..../BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":9,"bloomFilterArraySize":4650332,"primeBases":[5381,5381,5381,5381],"supportedDomains":"sXqgLAGjEMYcyKoT8nU3mKIS8AT7AaB9s/Cl7NSXDim0IqBOyWBIEiwm0CbyE+mgdgSgV7E5E/hd7d1CcQDmuMqwZdJo6Qgy8KZE3PDR9TkJl3jHKUAwF08DG/ai+qeCKVJq9Nu2PJLb5Jnv/I7y5eMWZMB8jSbC1pBQ/rhlWMqet4DRXyQ5qG1kO7/n/290mZTiMZuZ55nX1Ghe1aqKtMcGBsTZB42GTKpEZfpGqKiVz32DsEoJQID28idCK8kMsGzUY4ouFk/cGvq+vBMNiPAzLjlYW2k/NjUM1BXzLEQWUcsrVCBb+x7u5Jvj0SIp4FIEBok1fSl+Ch4JA05MeNcN44fHjepTEeybAWCMItICMoAoicQCdDu4+/8eUGpoSUkCCF4CUpouwhIAJUJa+FJ8hy1MUAFCUCsCX7b/OrYOf3IopeuRQvCsqPX507lwK3q8qZlwmAKHeMYVidzdgDRlm1oC+a9JCtwzoMAAaRhouTeK4RTRxiepqQTIJ0sBgAUI8NiN4NVneurGbs8BXTMK8ocGIKc6i5UY0rKEiJhDVWLgIcCEQr1sF6akD1+tWkOkE6McwI+GgjZQi6kruvb6+UJsl3Ytlg1AnVNCnAwoNJkkGjHVEh5wXi1M0bd3em66+y+zmySf7ogDSOYJJbyhTydFDLwv6+nT4mE3JgopL/q3Bgt2iTPho2RAVUqIbjqnBiFYhBUDdUoJR5VSBEyCDl7d1sqMM947ndDv/pJDrsABYy3ARBUAEfaKjjwsAyweR4SWqpkkAhGok3gPc8TkpautAwh0sIw6NQUABJAM0DKBMaamfGxXQcmi7q5tkW4C1fSvYnwJACo

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):516
                                                                                                                                                                                                Entropy (8bit):5.2260438524889485
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:a/vVaYebn9GFUt8Xq/+X/5OaYebn95Z9gdf0COtfBKXNh:aHVaYeb9ig8XzROaYeb9zKqCOyNh
                                                                                                                                                                                                MD5:AB19D036C8361A9E8C322E57C4A77528
                                                                                                                                                                                                SHA1:0084B51CB57A935853E454B9630B5B9592AF8E9C
                                                                                                                                                                                                SHA-256:9343F47F044BABE7EC864455C3209DF234161CCE21B7995627F425DB195AADD6
                                                                                                                                                                                                SHA-512:519BF2E9E2CAA660095B9626762EE45B30D22A96EB5876D2D8F0B3BC01B37A5677101A1D1B72C32887A4B6C44B656DAE212C3BDB2EF849766FCFF9D25A96100C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.238 2448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/02/15-23:20:27.245 2448 Recovering log #3.2024/02/15-23:20:27.248 2448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/02/15-23:20:46.792 1d58 Level-0 table #5: started.2024/02/15-23:20:46.906 1d58 Level-0 table #5: 783593 bytes OK.2024/02/15-23:20:46.908 1d58 Delete type=0 #3.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):516
                                                                                                                                                                                                Entropy (8bit):5.2260438524889485
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:a/vVaYebn9GFUt8Xq/+X/5OaYebn95Z9gdf0COtfBKXNh:aHVaYeb9ig8XzROaYeb9zKqCOyNh
                                                                                                                                                                                                MD5:AB19D036C8361A9E8C322E57C4A77528
                                                                                                                                                                                                SHA1:0084B51CB57A935853E454B9630B5B9592AF8E9C
                                                                                                                                                                                                SHA-256:9343F47F044BABE7EC864455C3209DF234161CCE21B7995627F425DB195AADD6
                                                                                                                                                                                                SHA-512:519BF2E9E2CAA660095B9626762EE45B30D22A96EB5876D2D8F0B3BC01B37A5677101A1D1B72C32887A4B6C44B656DAE212C3BDB2EF849766FCFF9D25A96100C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.238 2448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/02/15-23:20:27.245 2448 Recovering log #3.2024/02/15-23:20:27.248 2448 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/02/15-23:20:46.792 1d58 Level-0 table #5: started.2024/02/15-23:20:46.906 1d58 Level-0 table #5: 783593 bytes OK.2024/02/15-23:20:46.908 1d58 Delete type=0 #3.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):103
                                                                                                                                                                                                Entropy (8bit):5.221734058382156
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:scoBAIxQRDKIVjWQYThinCQTPxFxN3erkEtl:scoBY7jPYQDTPxFDkHl
                                                                                                                                                                                                MD5:BDAFC13847220A7D155BB7B2F989AA1A
                                                                                                                                                                                                SHA1:9C865009E05E3491C04E4B86137ACE7B437A4004
                                                                                                                                                                                                SHA-256:38973355E4374EE9D9782DA5196B2660E6D579234C12AC990CC1AC87E5BA0FEA
                                                                                                                                                                                                SHA-512:9746F67A5B5818591723654F17328AFC6DA645A86F34CAC9F94027262F74D5D70C63BEB62F969CFD757E3643FA58819530153E819F148CF1FF0F6EA0394387C6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.|.."....leveldb.BytewiseComparator......^7a.7.............../.BLOOM_FILTER:.........DB_VERSION........

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):546
                                                                                                                                                                                                Entropy (8bit):5.932990530273369
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:TA9PNuc0wJtwvwJxyxLPXEwioRoTm/qVIRB6tFRHn:T/c09FdiGIVIRBwRH
                                                                                                                                                                                                MD5:60CE4016127778A53748343018A4CC68
                                                                                                                                                                                                SHA1:F08C5EA24C24F210248A87AA10E50F3C943EDB9C
                                                                                                                                                                                                SHA-256:F9FA6D5DA47094EAB1FC83758842CA598FE2EC0232F2E2CF2A17457C89F6BA16
                                                                                                                                                                                                SHA-512:A662FD87C114E9B9FAE037666E396814238A7DA935AEBC3E9D122B10B351D2FBB2E841BD571C843D90391D8D4407C64183EF2ACEB44125F24DD9E0CBBCAE1C57
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...m.................DB_VERSION.1/...................&QUERY_TIMESTAMP:domains_config_gz2.*.*.13352509264378541..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=%2Fwp1fD0xo8ywYyo5yFzHEjCMobUSk%2BZ4nmFYB%2FqjsBg%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-05-01T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":75},"hash":"EwG2gkfquexLj6u3yjHyiL4YQwdU318k1Hub+1rSDMI=","size":391864}]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):315
                                                                                                                                                                                                Entropy (8bit):5.1134337241533
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXV1N723oH+Tcwtk2WwnvB2KLlgGfXoL+q2PN723oH+Tcwtk2WwnvIFUv:agaYebkxwnvFLCbL+vVaYebkxwnQFUv
                                                                                                                                                                                                MD5:6A8B2C19A5F3904BD4830221855DA38C
                                                                                                                                                                                                SHA1:C9609453BFE43722C133A121C4A9298C56D2D93B
                                                                                                                                                                                                SHA-256:FBCD70DB125CD2C192BB4925BF7317EC1A4C98C6FFD6CB8613281D5AF442846F
                                                                                                                                                                                                SHA-512:C14594073317787C0E673F10C68F7A40F8C64231B98BB3F22128BB40B6F876BFA3C2C6FCD36423893B3544ED4412DFFD32214FE48C2E7B4096661E28D7B33797
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:54.608 2ecc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/02/15-23:20:54.645 2ecc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):41
                                                                                                                                                                                                Entropy (8bit):4.704993772857998
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):380
                                                                                                                                                                                                Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                                                MD5:9FE07A071FDA31327FA322B32FCA0B7E
                                                                                                                                                                                                SHA1:A3E0BAE8853A163C9BB55F68616C795AAAF462E8
                                                                                                                                                                                                SHA-256:E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
                                                                                                                                                                                                SHA-512:9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.1305674761412465
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQkjn+q2PN723oH+Tcwt8aPrqIFUt8XGfXQ7Zmw+XGfXQVVkwON723oH+TcwC:aijn+vVaYebL3FUt8Xl/+XrV5OaYebQJ
                                                                                                                                                                                                MD5:799461B917A3BA96696465C81A90029A
                                                                                                                                                                                                SHA1:51D6FC64ED9951E1DB62ACC13C892940596AC2DA
                                                                                                                                                                                                SHA-256:B15E1CF47891FA283DDE1492D720B43917131013EFD17F7CFF437E3282A3CFE9
                                                                                                                                                                                                SHA-512:014FE49426A7F7EF1EE530BB9992E68E4737252A9DEAE92189D595724ADFC49184017EF4342FDE1ACE020A7143A4F36A3185362F7C266E834542D4FD2F87C81C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.243 249c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/02/15-23:20:27.248 249c Recovering log #3.2024/02/15-23:20:27.251 249c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.1305674761412465
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQkjn+q2PN723oH+Tcwt8aPrqIFUt8XGfXQ7Zmw+XGfXQVVkwON723oH+TcwC:aijn+vVaYebL3FUt8Xl/+XrV5OaYebQJ
                                                                                                                                                                                                MD5:799461B917A3BA96696465C81A90029A
                                                                                                                                                                                                SHA1:51D6FC64ED9951E1DB62ACC13C892940596AC2DA
                                                                                                                                                                                                SHA-256:B15E1CF47891FA283DDE1492D720B43917131013EFD17F7CFF437E3282A3CFE9
                                                                                                                                                                                                SHA-512:014FE49426A7F7EF1EE530BB9992E68E4737252A9DEAE92189D595724ADFC49184017EF4342FDE1ACE020A7143A4F36A3185362F7C266E834542D4FD2F87C81C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.243 249c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/02/15-23:20:27.248 249c Recovering log #3.2024/02/15-23:20:27.251 249c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):380
                                                                                                                                                                                                Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                                                MD5:9FE07A071FDA31327FA322B32FCA0B7E
                                                                                                                                                                                                SHA1:A3E0BAE8853A163C9BB55F68616C795AAAF462E8
                                                                                                                                                                                                SHA-256:E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
                                                                                                                                                                                                SHA-512:9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):332
                                                                                                                                                                                                Entropy (8bit):5.1562821915422745
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQe3+q2PN723oH+Tcwt865IFUt8XGfXQB3XZmw+XGfXQoVkwON723oH+TcwtD:aM3+vVaYeb/WFUt8XLX/+XaV5OaYeb/L
                                                                                                                                                                                                MD5:07CC49FC7B049BEE1FDDF07E768B2F22
                                                                                                                                                                                                SHA1:588AF1B5077B01667DC9AE084D2F092CA533F54D
                                                                                                                                                                                                SHA-256:0E2BB1AB3B26A117B7C454E34BCA49B9EEB96B2733BB6E063C45B0DBD8768B59
                                                                                                                                                                                                SHA-512:3F714C66D580378F03D8CF56F95F0069CC13B3834B39FD82D83B6DDE252B71CEDF96F9A767206870456C8C3A87FB4EFAC15179F9FA7B09F992D957EB98B5530D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.373 249c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/02/15-23:20:27.417 249c Recovering log #3.2024/02/15-23:20:27.418 249c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):332
                                                                                                                                                                                                Entropy (8bit):5.1562821915422745
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQe3+q2PN723oH+Tcwt865IFUt8XGfXQB3XZmw+XGfXQoVkwON723oH+TcwtD:aM3+vVaYeb/WFUt8XLX/+XaV5OaYeb/L
                                                                                                                                                                                                MD5:07CC49FC7B049BEE1FDDF07E768B2F22
                                                                                                                                                                                                SHA1:588AF1B5077B01667DC9AE084D2F092CA533F54D
                                                                                                                                                                                                SHA-256:0E2BB1AB3B26A117B7C454E34BCA49B9EEB96B2733BB6E063C45B0DBD8768B59
                                                                                                                                                                                                SHA-512:3F714C66D580378F03D8CF56F95F0069CC13B3834B39FD82D83B6DDE252B71CEDF96F9A767206870456C8C3A87FB4EFAC15179F9FA7B09F992D957EB98B5530D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.373 249c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/02/15-23:20:27.417 249c Recovering log #3.2024/02/15-23:20:27.418 249c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1140
                                                                                                                                                                                                Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                                                                                                                                MD5:914FD8DC5F9A741C6947E1AB12A9D113
                                                                                                                                                                                                SHA1:6529EFE14E7B0BEA47D78B147243096408CDAAE4
                                                                                                                                                                                                SHA-256:8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
                                                                                                                                                                                                SHA-512:2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.121147340711161
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfX89i+q2PN723oH+Tcwt8NIFUt8XGfX8hXZmw+XGfX8h3VkwON723oH+Tcwt8n:aBi+vVaYebpFUt8XFX/+XF3V5OaYebqJ
                                                                                                                                                                                                MD5:C415BB5C5AD8DB56F84369BC27374403
                                                                                                                                                                                                SHA1:F059C321236EABA2678A44EECF23B2FFE81FF01B
                                                                                                                                                                                                SHA-256:605B161C79EDE6281905FCD162594EA053781468E4E01137B792249D3FF1E6DD
                                                                                                                                                                                                SHA-512:4DB37B49F8D25ACFB1040049612454AB3297F7D7277CB583F81E1A159BFEA04A993C9B358C33CB7C579F6E3C2BB8B5BB1CFEE3E40B8FCB62D780F8C39AD13134
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.587 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/02/15-23:20:28.588 23dc Recovering log #3.2024/02/15-23:20:28.588 23dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.121147340711161
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfX89i+q2PN723oH+Tcwt8NIFUt8XGfX8hXZmw+XGfX8h3VkwON723oH+Tcwt8n:aBi+vVaYebpFUt8XFX/+XF3V5OaYebqJ
                                                                                                                                                                                                MD5:C415BB5C5AD8DB56F84369BC27374403
                                                                                                                                                                                                SHA1:F059C321236EABA2678A44EECF23B2FFE81FF01B
                                                                                                                                                                                                SHA-256:605B161C79EDE6281905FCD162594EA053781468E4E01137B792249D3FF1E6DD
                                                                                                                                                                                                SHA-512:4DB37B49F8D25ACFB1040049612454AB3297F7D7277CB583F81E1A159BFEA04A993C9B358C33CB7C579F6E3C2BB8B5BB1CFEE3E40B8FCB62D780F8C39AD13134
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.587 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/02/15-23:20:28.588 23dc Recovering log #3.2024/02/15-23:20:28.588 23dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                Entropy (8bit):2.8703492788661986
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:rBCy66rhLT5JjDG6rhLIkswOwQInOj2KBgcuuoKwkYjDTXHjelS9nsH4/Aztc:NN66tpU6tDtOwHwhgcPo1/37sHXzC
                                                                                                                                                                                                MD5:B6ECA0AE528350687ABD0DAF206D108A
                                                                                                                                                                                                SHA1:01303220CB6C52D8F861D65C21494C2C1172FEDD
                                                                                                                                                                                                SHA-256:0E1DFB9FF091F3EE60F83260B581630CAD4CB51BC836FCFABE329C58A4555C75
                                                                                                                                                                                                SHA-512:D2AC6573466148F3C871807030703AECBB60A527666D5BD827EA5D1A40355D4C4B7F82D96540A5A1E1EFE2EDE733BC001BF83BD8A9FC90A32424016FB134F9D6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                Entropy (8bit):0.7525141088935146
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:KW6ts9oXhH+bDo3iN0Z2TVJkXBBE3ybHv6t1:KJsmXhIU3iGAIBBE3qY1
                                                                                                                                                                                                MD5:24A315F84543329C1A5D0014D443ED35
                                                                                                                                                                                                SHA1:1858757072F0FC465A1041427AAC153044C40928
                                                                                                                                                                                                SHA-256:83A5709A4ABE4959A36F0477179803BBF012874FC85E6D5CF03E8CFD229C37A5
                                                                                                                                                                                                SHA-512:6CCE60FA923E8E8D00EADA6F7AF386E36622EA8707EDE3DBC72241450AF7AC66F0068B352D4F3C3342871DF94ADBF02CEC5AD8B8BF7F863E4870E5AE26C3E85E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):115717
                                                                                                                                                                                                Entropy (8bit):5.183660917461099
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                                                MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                                                SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                                                SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                                                SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45056
                                                                                                                                                                                                Entropy (8bit):3.9180759106859213
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:jj9P02773pLHjliP/KbtEgam6IXcOQkQerORKToaADhf:jdH7lliP/U8Oe2ORKc39
                                                                                                                                                                                                MD5:EE61BA80D3C4688FB3E53A1D73D51A80
                                                                                                                                                                                                SHA1:5BBEE995B2D946B31BDFFC3FBCD3D5ABD49D4A27
                                                                                                                                                                                                SHA-256:F1A51248E440BF5D5E9EAB5959C438B3A21B5164C06438135DAE950CA8685B52
                                                                                                                                                                                                SHA-512:153D2EE2C5E7B051527D6A37F04401D0B289B09F9B3BDBC16CF59A5C0EAD455C566F064BF9C18A435A844A39061624A1D9779268267AA68731B03548A6BBCFFF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):381641
                                                                                                                                                                                                Entropy (8bit):6.089833774590263
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:pTUDd7S0LBvo6i+45Idoo4RLpILvKOWyUS6PtIvJZLBvo6k+45Idoo0TGIYQ/17E:YLBQ6i+45IdooOtITLBQ6k+45IdooaYJ
                                                                                                                                                                                                MD5:BB575B56326F577AF2AAA631FF4C7DE7
                                                                                                                                                                                                SHA1:F9B4181504AA92D9CB930F404AFFEEAEBC9CD900
                                                                                                                                                                                                SHA-256:C55235CB3AC432D6B3A613291B1E707EF6209487AAC4E4DA117F17D72274379D
                                                                                                                                                                                                SHA-512:CEC7298637807E3FA4CEAECD8461A70147BF515994A80D4DA1737D942CBC311E084E18BF05491B877F22B067385DFDC275F18ED04F2E73DACD9DF4F7A8F1752E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:. ......................2......."....................................xw:hv........................K.......h.t.t.p.s._.w.w.w...y.o.u.t.u.b.e...c.o.m._.0.@.1..Y.t.I.d.b.M.e.t.a....................R.g.L.............................2.......................2........................L.................................2....d.a.t.a.b.a.s.e.s......2........a.c.t.u.a.l.N.a.m.e......2..........2..........2..........2..........2..........2.............d.a.t.a.b.a.s.e.s........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................d.a.t.a.b.a.s.e.s...... .................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):359
                                                                                                                                                                                                Entropy (8bit):5.292707160163924
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfX31N723oH+TcwtEqSAxG7RB2KLlgGfXJXmd3+q2PN723oH+TcwtEqSAxG7VIg:aeaYebXG7RFLCyvVaYebXG7iFUv
                                                                                                                                                                                                MD5:C84EC8B8946B77A8D50047EB79FDFE66
                                                                                                                                                                                                SHA1:8D0F98627DC5DF20652BC0AFEDBB1A287DAB11E7
                                                                                                                                                                                                SHA-256:F3439F40FB7893F9E988C1BEC334BC656F1C4157879BE65DF9A8E730FF47E75F
                                                                                                                                                                                                SHA-512:282E7D2725C833A9246FD11A4C208098CA15C292501006C870D4B71B9A4F3A1ADEF5F6043CC2082FAA84F92BF678D37293380A895EBBFEF3405F86D552FE7641
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:38.117 1d58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb since it was missing..2024/02/15-23:20:38.143 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):23
                                                                                                                                                                                                Entropy (8bit):4.142914673354254
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Fdb+4Ll:Zl
                                                                                                                                                                                                MD5:3FD11FF447C1EE23538DC4D9724427A3
                                                                                                                                                                                                SHA1:1335E6F71CC4E3CF7025233523B4760F8893E9C9
                                                                                                                                                                                                SHA-256:720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
                                                                                                                                                                                                SHA-512:10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:........idb_cmp1......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):412
                                                                                                                                                                                                Entropy (8bit):5.196699931881873
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:awOi+vVaYeb8rcHEZrELFUt8XwXr/+XwX7V5OaYeb8rcHEZrEZSJ:a7TVaYeb8nZrExg8X5iOaYeb8nZrEZe
                                                                                                                                                                                                MD5:3A19BECF7D9F49EBAFCEF9EBA9DDA541
                                                                                                                                                                                                SHA1:2670C83200D22224201EC214ADD40F61E60BB19D
                                                                                                                                                                                                SHA-256:41560403B0547C5D7D8F24E382018BF6107640E9493C8E0510A721984F281C7A
                                                                                                                                                                                                SHA-512:F37911AC5383D0622FA93E6098485F466B0361E021B86F57FE85B71CC7002B9E2A7C9AB27D32FF7301B52FA1CEC6D6F095DA2B2E8E1C554380BA09125C377350
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:32.580 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/02/15-23:20:32.582 23dc Recovering log #3.2024/02/15-23:20:32.582 23dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):412
                                                                                                                                                                                                Entropy (8bit):5.196699931881873
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:awOi+vVaYeb8rcHEZrELFUt8XwXr/+XwX7V5OaYeb8rcHEZrEZSJ:a7TVaYeb8nZrExg8X5iOaYeb8nZrEZe
                                                                                                                                                                                                MD5:3A19BECF7D9F49EBAFCEF9EBA9DDA541
                                                                                                                                                                                                SHA1:2670C83200D22224201EC214ADD40F61E60BB19D
                                                                                                                                                                                                SHA-256:41560403B0547C5D7D8F24E382018BF6107640E9493C8E0510A721984F281C7A
                                                                                                                                                                                                SHA-512:F37911AC5383D0622FA93E6098485F466B0361E021B86F57FE85B71CC7002B9E2A7C9AB27D32FF7301B52FA1CEC6D6F095DA2B2E8E1C554380BA09125C377350
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:32.580 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/02/15-23:20:32.582 23dc Recovering log #3.2024/02/15-23:20:32.582 23dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1471
                                                                                                                                                                                                Entropy (8bit):5.706507697274955
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:j9W6t1HDHRqLlaW6e/tTj3+oP2JRlAsEW0z2reS1GEku1GM255PE/ESWbQJ:j9D/jHHDepD+oP2JzglGeqGN2GM05PEN
                                                                                                                                                                                                MD5:91B774F835711BBA8F08791C85A0FE87
                                                                                                                                                                                                SHA1:49DCA9E1A2E2577245AFD0081B521250D6754717
                                                                                                                                                                                                SHA-256:8E92BC22ECC357337E3380AD25BF75A3FF97CDF97D9208AC9AA4F5CBAA32CBF9
                                                                                                                                                                                                SHA-512:8CEE8E8F7E937993F8A150CF9067378B20FAF141012160D2E11818EEF76A86B8FC4417C14E41B42C4A69C148DC80437D25B725A298333D64339F9409E3A7B367
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...................VERSION.1..META:https://www.youtube.com...........|.._https://www.youtube.com..__sak..1.6_https://www.youtube.com..ytidb::LAST_RESULT_ENTRY_KEYW.{"data":{"hasSucceededOnce":true},"expiration":1710627638301,"creation":1708035638302}hQ..................META:https://www.youtube.com.............5_https://www.youtube.com..yt-remote-connected-devicesB.{"data":"[]","expiration":1708122067425,"creation":1708035667425}.-_https://www.youtube.com..yt-remote-device-idd.{"data":"e38924db-ce41-4598-935a-9b96e9aeb7d2","expiration":1739571667402,"creation":1708035667402}.6_https://www.youtube.com..ytidb::LAST_RESULT_ENTRY_KEYW.{"data":{"hasSucceededOnce":true},"expiration":1710627666950,"creation":1708035666950}.._https://www.youtube.com..__sak.Q.]e................META:https://www.facebook.com.............."_https://www.facebook.com..Session..5cj1em:1708035747051.4_https://www.facebook.com..banzai:last_storage_flush..1708035716625.8.'_https://www.facebook.com..hb_timestamp..1708

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):340
                                                                                                                                                                                                Entropy (8bit):5.1284755254743715
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXY/U0Qyq2PN723oH+Tcwt8a2jMGIFUt8XGfXYWM0G1Zmw+XGfXYtU0QRkwONP:a/U0QyvVaYeb8EFUt8X90g/+Xm0QR5OP
                                                                                                                                                                                                MD5:751ABC8EB693AB90C9298A3664DF0300
                                                                                                                                                                                                SHA1:7A8C414E773EB91B0D8E4DE038B2D44EFD63F56B
                                                                                                                                                                                                SHA-256:E80B190015ADC5FBC12A4865ACA531CCC3201322332795A3B788E593F7C492A1
                                                                                                                                                                                                SHA-512:90A21D96E4AEE93A389DF222DEBDC72747C3E5FE905F53E37AA46E879F89E43170AA32F75ECDDA3C6874F62C810B51748CFAA1349DF44976267585BE7738FCC2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.982 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/02/15-23:20:28.983 2814 Recovering log #3.2024/02/15-23:20:28.988 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):340
                                                                                                                                                                                                Entropy (8bit):5.1284755254743715
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXY/U0Qyq2PN723oH+Tcwt8a2jMGIFUt8XGfXYWM0G1Zmw+XGfXYtU0QRkwONP:a/U0QyvVaYeb8EFUt8X90g/+Xm0QR5OP
                                                                                                                                                                                                MD5:751ABC8EB693AB90C9298A3664DF0300
                                                                                                                                                                                                SHA1:7A8C414E773EB91B0D8E4DE038B2D44EFD63F56B
                                                                                                                                                                                                SHA-256:E80B190015ADC5FBC12A4865ACA531CCC3201322332795A3B788E593F7C492A1
                                                                                                                                                                                                SHA-512:90A21D96E4AEE93A389DF222DEBDC72747C3E5FE905F53E37AA46E879F89E43170AA32F75ECDDA3C6874F62C810B51748CFAA1349DF44976267585BE7738FCC2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.982 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/02/15-23:20:28.983 2814 Recovering log #3.2024/02/15-23:20:28.988 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\MediaDeviceSalts

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 6, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24576
                                                                                                                                                                                                Entropy (8bit):0.46046243469326303
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:TLiCwbvwsw9VwLwcORslcDw3wJ6UwccI5fBoj+zQAw/pD1CzES:TxKX0wxORAmA/U1cEBojQcD1g
                                                                                                                                                                                                MD5:C747C2F962B2DC6940347BA710D2843C
                                                                                                                                                                                                SHA1:1156FDD88A0FFB8882073B9F5C9D1A48B7C12541
                                                                                                                                                                                                SHA-256:D07200B99536094432DED489ED552AA1DB609C7896BAA94AB56F5E82151C5253
                                                                                                                                                                                                SHA-512:F452DB386B9654851B156187AD1A4BE8AA5726F371B8D0043B378E8920675A32243A9A34B5ECE42CA5FEA63E98CCB34AAFA04F342A5AFBE1756DA2672FDD12C6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...p."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\208ec23a-f35d-4c5e-b02f-9ed2cb23cfb5.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1452
                                                                                                                                                                                                Entropy (8bit):5.287526653429432
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
                                                                                                                                                                                                MD5:C11A0C2888E9122AF3E0A9532E7CF485
                                                                                                                                                                                                SHA1:213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
                                                                                                                                                                                                SHA-256:F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
                                                                                                                                                                                                SHA-512:BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\33de68f8-9e9a-4044-89ca-cebda1d62086.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.475762340763189
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOUT7XI1YDr9cyR8wXwlmUUAnIMOqdQTSAcRG/SBv31dB8wXwlmUUAnIMp5M:YWy1UT7XI2pcO+UAnIGQTSAcR1R7N+Ut
                                                                                                                                                                                                MD5:ABC190ED7CC97A2E1A35820E567E10BA
                                                                                                                                                                                                SHA1:8B3C12DD2275EC19AB4F1EEDF22E344CF10B8820
                                                                                                                                                                                                SHA-256:1FF9C4400F3261A4AA414E06D48C342A313FE1FA7C34DEC0E242B6E688B22AB1
                                                                                                                                                                                                SHA-512:EAD00E3AFD24659EE253D2B95361FE4FE85EEB62FF1990C6B61EB45BC103C3D90C7BF985C9D33DCAB223964C08901912BB455038EF542A763E81F2772D2C8E7E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571639.720815,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035639.720818},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\65522651-09ba-4cea-bce8-bb2985197e08.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):523
                                                                                                                                                                                                Entropy (8bit):5.520166610836716
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:YWytaA9dn+UAnIYAcSXI2pcO+UAnIYhsCx48R7N+UAnI7NQ:YhZEUC4tSUChus7wUtNQ
                                                                                                                                                                                                MD5:DACD9B6ABD3AE162044C8C01F85BC4D0
                                                                                                                                                                                                SHA1:66A320E95F8434967D24FC47A2842FF410C20023
                                                                                                                                                                                                SHA-256:03F366C3422C50887951532A1F89D6EBB895BFF6FDDD846C55D30B5169A48698
                                                                                                                                                                                                SHA-512:C7A2690FF03F549897A190F98AD1FD8D2BA9949D7C6076B4CA5D4580D4479EE3F551175ECF0829436C5B652963C82C07723DBBF59F9A3E14BD4869DFCA9550BC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1723587716.810434,"host":"TZmujbl93Yt3JI8wZ4X/zjkA0WFNGNW44A+o7h4YyHw=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035716.810438},{"expiry":1739571710.803536,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035710.803541},{"expiry":1739571717.914006,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035717.91401}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7680d5d5-46d6-4348-bbe9-57e8f7715c0c.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8fe53f9f-a8c9-4bbd-996b-fa796d166b82.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4487
                                                                                                                                                                                                Entropy (8bit):5.28736160656863
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:Due2fhKSUKB2kVlu3HusNMJumvu/ubr01u7SE08u7oCu74pu7y4murNyVu7fo1ul:D9shKSUKB28lgHlMJlu/Sr01w08dCJpO
                                                                                                                                                                                                MD5:EF9EEA92CF4F2BFEF48F643EA72A33CC
                                                                                                                                                                                                SHA1:05F60DD5E9AB306990A4034C325F90E6A3C3D474
                                                                                                                                                                                                SHA-256:8B2FC5DDDD104F4DCDD0448757218AD8274D1285BD6EEEDD5B491E681CAB6030
                                                                                                                                                                                                SHA-512:4E5263B547ACC64762FEF93619210263034D7AB460BE7ED80BD4D16786B748BEA0B77B24902FA505E1E93E8C5F9DE23B31636BCEBE274085FEA9749B6E8FE813
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"broken_alternative_services":[{"anonymization":["GAAAABMAAABodHRwczovL3lvdXR1YmUuY29tAA==",false],"broken_count":2,"broken_until":"1708035961","host":"fonts.googleapis.com","port":443,"protocol_str":"quic"}],"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13355101231122906","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13355101246890041","port":443,"protocol_str":"quic"}],"anonymizati

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                Entropy (8bit):1.4369414230502777
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:TsKLopF+SawLUO1Xj8BazxjRo0CtMwdQkCZlPtqjeu+o9ThaFjidRo55H4GE:te+Auazxi5tOnPtOexQThaFGdi55HDE
                                                                                                                                                                                                MD5:014839C54F173E23C814D6961504811D
                                                                                                                                                                                                SHA1:E3F097F5E0A1CBE3441C06112548C14BC45CDDBA
                                                                                                                                                                                                SHA-256:DBAE73472421216755347EC6C7FFEE4A0B638666E17EBE9BA5807E9E07CE5562
                                                                                                                                                                                                SHA-512:42628A7AEC9CB16A6696D7F8D392F376C0275748A548457560702248BCA4FB45855E3653C20C49D93E1B2C8CEAD4AA40077D189D64C3AACF097076B39FD2B96C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1452
                                                                                                                                                                                                Entropy (8bit):5.287526653429432
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
                                                                                                                                                                                                MD5:C11A0C2888E9122AF3E0A9532E7CF485
                                                                                                                                                                                                SHA1:213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
                                                                                                                                                                                                SHA-256:F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
                                                                                                                                                                                                SHA-512:BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4f5a7.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1452
                                                                                                                                                                                                Entropy (8bit):5.287526653429432
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
                                                                                                                                                                                                MD5:C11A0C2888E9122AF3E0A9532E7CF485
                                                                                                                                                                                                SHA1:213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
                                                                                                                                                                                                SHA-256:F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
                                                                                                                                                                                                SHA-512:BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):36864
                                                                                                                                                                                                Entropy (8bit):2.0625170629625944
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:JkIEumQv8m1ccnvS6nio0dnxVCuuR7QgVT0UwGHD1ZeU/alKShnCphzuMxpQy7Fm:+IEumQv8m1ccnvS6niWz9jo/wi+nMtD
                                                                                                                                                                                                MD5:32079E974ACE36964BB3BFECA5984336
                                                                                                                                                                                                SHA1:D59A67FEE2C319E5012790074EEC3F0C6E8D69D3
                                                                                                                                                                                                SHA-256:D11FFDF8584AB7F3EF65C34B7C0F9E9D20EE8983E2394B129410C6B2B6585C35
                                                                                                                                                                                                SHA-512:15C6C8676D452EFAD90AA45A6992A7303ACCDD1AA2CDD2E923D6A39ACC1299153C5D07043E9C68E341BC7EFCA509A6752C45D148A398B43E921B233E308A10BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4082a.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.475762340763189
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOUT7XI1YDr9cyR8wXwlmUUAnIMOqdQTSAcRG/SBv31dB8wXwlmUUAnIMp5M:YWy1UT7XI2pcO+UAnIGQTSAcR1R7N+Ut
                                                                                                                                                                                                MD5:ABC190ED7CC97A2E1A35820E567E10BA
                                                                                                                                                                                                SHA1:8B3C12DD2275EC19AB4F1EEDF22E344CF10B8820
                                                                                                                                                                                                SHA-256:1FF9C4400F3261A4AA414E06D48C342A313FE1FA7C34DEC0E242B6E688B22AB1
                                                                                                                                                                                                SHA-512:EAD00E3AFD24659EE253D2B95361FE4FE85EEB62FF1990C6B61EB45BC103C3D90C7BF985C9D33DCAB223964C08901912BB455038EF542A763E81F2772D2C8E7E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571639.720815,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035639.720818},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF44775.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.475762340763189
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOUT7XI1YDr9cyR8wXwlmUUAnIMOqdQTSAcRG/SBv31dB8wXwlmUUAnIMp5M:YWy1UT7XI2pcO+UAnIGQTSAcR1R7N+Ut
                                                                                                                                                                                                MD5:ABC190ED7CC97A2E1A35820E567E10BA
                                                                                                                                                                                                SHA1:8B3C12DD2275EC19AB4F1EEDF22E344CF10B8820
                                                                                                                                                                                                SHA-256:1FF9C4400F3261A4AA414E06D48C342A313FE1FA7C34DEC0E242B6E688B22AB1
                                                                                                                                                                                                SHA-512:EAD00E3AFD24659EE253D2B95361FE4FE85EEB62FF1990C6B61EB45BC103C3D90C7BF985C9D33DCAB223964C08901912BB455038EF542A763E81F2772D2C8E7E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571639.720815,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035639.720818},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF464a2.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.475762340763189
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOUT7XI1YDr9cyR8wXwlmUUAnIMOqdQTSAcRG/SBv31dB8wXwlmUUAnIMp5M:YWy1UT7XI2pcO+UAnIGQTSAcR1R7N+Ut
                                                                                                                                                                                                MD5:ABC190ED7CC97A2E1A35820E567E10BA
                                                                                                                                                                                                SHA1:8B3C12DD2275EC19AB4F1EEDF22E344CF10B8820
                                                                                                                                                                                                SHA-256:1FF9C4400F3261A4AA414E06D48C342A313FE1FA7C34DEC0E242B6E688B22AB1
                                                                                                                                                                                                SHA-512:EAD00E3AFD24659EE253D2B95361FE4FE85EEB62FF1990C6B61EB45BC103C3D90C7BF985C9D33DCAB223964C08901912BB455038EF542A763E81F2772D2C8E7E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571639.720815,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035639.720818},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF50036.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.475762340763189
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOUT7XI1YDr9cyR8wXwlmUUAnIMOqdQTSAcRG/SBv31dB8wXwlmUUAnIMp5M:YWy1UT7XI2pcO+UAnIGQTSAcR1R7N+Ut
                                                                                                                                                                                                MD5:ABC190ED7CC97A2E1A35820E567E10BA
                                                                                                                                                                                                SHA1:8B3C12DD2275EC19AB4F1EEDF22E344CF10B8820
                                                                                                                                                                                                SHA-256:1FF9C4400F3261A4AA414E06D48C342A313FE1FA7C34DEC0E242B6E688B22AB1
                                                                                                                                                                                                SHA-512:EAD00E3AFD24659EE253D2B95361FE4FE85EEB62FF1990C6B61EB45BC103C3D90C7BF985C9D33DCAB223964C08901912BB455038EF542A763E81F2772D2C8E7E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571639.720815,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035639.720818},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6095fab-f8bf-41d2-8973-f0a93fb5f1b9.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4487
                                                                                                                                                                                                Entropy (8bit):5.287518825689878
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:Due2fhKSUKB2kVlu3HusNMJumvu/ubr01u7SE08u7oCu74pu7y4murNyVu7fo1uU:D9shKSUKB28lgHlMJlu/Sr01w08dCJpL
                                                                                                                                                                                                MD5:E4A06DCC5CCDBB7D77E4A12D0658D93A
                                                                                                                                                                                                SHA1:DCCBBC16B0059DBBFFDAAF99C71014761576FE1B
                                                                                                                                                                                                SHA-256:67DAD2C2B3C944CD595296FB3011A087713B804ACA63314DA5CF3AAC6EAD4421
                                                                                                                                                                                                SHA-512:428FDF5A8A25ECED0B3FEB256D862DD575DBE9D8BEFD98641FFBE13392A33B0372474D1A8F55E2320609FF893B65A979562C73BB728EFCBFBC5A41A35B1790E2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"broken_alternative_services":[{"anonymization":["GAAAABMAAABodHRwczovL3lvdXR1YmUuY29tAA==",false],"broken_count":2,"broken_until":"1708035961","host":"fonts.googleapis.com","port":443,"protocol_str":"quic"}],"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13355101231122906","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13355101246890041","port":443,"protocol_str":"quic"}],"anonymizati

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c758ad2c-1eeb-426a-93cc-98cbeec29783.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.483294253986531
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOVJt7XI1YDr9cyR8wXwlmUUAnIMOqmhRG/SBv31dB8wXwlmUUAnIMp5qTk2:YWy1jJXI2pcO+UAnI3hR1R7N+UAnIGQ
                                                                                                                                                                                                MD5:080F206A8E02A500210931ECB6BC1369
                                                                                                                                                                                                SHA1:1F3826EEE0594BA1E37313DBB69DFCA4FAB5AD5A
                                                                                                                                                                                                SHA-256:B048DFDE5742C5F5B96C8FCDDDAFE5E6AEEF662D33AEA6C9C614A510FB98B81E
                                                                                                                                                                                                SHA-512:BDA63420BF7CDD43FEB38CFF8274640A4A658E2A9940972A6AF161F882C3C0147C22FD523DCA7A5B77DE3FC350E43801C3F975DBF0F96DC24A2AB3B56D4B3C64
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571676.862407,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035676.862411},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c99e9991-721b-42d4-9bd2-6d2dc98d7218.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):355
                                                                                                                                                                                                Entropy (8bit):5.482187095239784
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:YWyWNOcI7XI1YDr9cyR8wXwlmUUAnIMOqiykeRG/SBv31dB8wXwlmUUAnIMp5qTZ:YWy1cEXI2pcO+UAnIl9eR1R7N+UAnIGQ
                                                                                                                                                                                                MD5:7943028F6A7378BC038D583297D4998F
                                                                                                                                                                                                SHA1:F2D8CA218D86A0AA4EE9515CEEE20CB40B4E7688
                                                                                                                                                                                                SHA-256:CD1BC3AD7991B322C1A4F502062C4842C434C716252CFC21F81F1BB62E519B65
                                                                                                                                                                                                SHA-512:B257EA768436D663990E9204B8202CBAC3DA9BE2D4334D184FF95FA248F81D7AD863ED51A3654DDF6FC0C9637A20796509830A1C8265007CF5F3B9D2A310FFDE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sts":[{"expiry":1739571656.260407,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708035656.26041},{"expiry":1739571637.543949,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708035637.543955}],"version":2}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf3c5716-45c5-4030-828c-38c77bd24d2f.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd9566ff-8a43-4e73-bc8e-860cfcc2bc6e.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                Entropy (8bit):0.7391107375212417
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isvhldvd0dtdjiG1d6XfN:TLSOUOq0afDdWec9sJAhvlXI7J5fc
                                                                                                                                                                                                MD5:A74BFDCBFB880F469AD54BEF7B1B0C88
                                                                                                                                                                                                SHA1:0012DD82FEB43839A30557EAF9E8DB2EB7259142
                                                                                                                                                                                                SHA-256:63DFF3D10BF10F8F5326776956AF6DE1463CF0A14792C4451D4A76EFA1BF4BA2
                                                                                                                                                                                                SHA-512:203FC220BF05344052340CCC6F77233669C200FDC6596EEE6F5D1E2203328D7D116BF07DE664D1D60EA2CD96F006406A9F0A2035BFAA86C93A103193E6EA4583
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e948.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44f35.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4d09a.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4f643.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF5217a.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9631
                                                                                                                                                                                                Entropy (8bit):5.1097520333425965
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttkdhsvbaFvrE9kjN3r8WbV+F5UQaXU2PHYJ:sttWsvbCDHbGyQ1D
                                                                                                                                                                                                MD5:9CCB31180D5A21AAB50A046C08CCF41A
                                                                                                                                                                                                SHA1:90AFB807B9D8D6328F416A796A88CF46B52F2A2C
                                                                                                                                                                                                SHA-256:C8C0396BD5F043E31EA12C98BAC2CDE5084FF43FEF2E723A67A7B6352F02F1AF
                                                                                                                                                                                                SHA-512:D86A3A36A957D9074777CC669EED8E0F71DBEEACFCCB5BDC7EEFF82168D9C452195ECA1A4DCDB69445D1574D44C5D0F32E5BB11C49E26FC97058775F5B32DAF0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24853
                                                                                                                                                                                                Entropy (8bit):5.564953021574742
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:OCLrEbWodW5wQOf4aB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDvI8B+OrwXnpJtuR:OyIb7dWaQOfXBu1jaq1MLftu
                                                                                                                                                                                                MD5:590D8C7F13EA9202A1DBFEB28C128DFD
                                                                                                                                                                                                SHA1:67F290BF17859A900AB0227EE3703F2C5D409A47
                                                                                                                                                                                                SHA-256:1AFBCABBCD7A5C915D2BA33F45D4C9144A3B3249D06A0175118B2790B6D1E66E
                                                                                                                                                                                                SHA-512:F5EA048BF1C0C4AE491E7A6590ADF21F6B8317FFD6C361D0EE037DC679747582DAA7E8EFE8FF6225FF8BF2621CD47192DFE8A00E4A1BA74B0CDE324EC57B610F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352509227058513","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352509227058513","location":5,"ma

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40665.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24853
                                                                                                                                                                                                Entropy (8bit):5.564953021574742
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:OCLrEbWodW5wQOf4aB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDvI8B+OrwXnpJtuR:OyIb7dWaQOfXBu1jaq1MLftu
                                                                                                                                                                                                MD5:590D8C7F13EA9202A1DBFEB28C128DFD
                                                                                                                                                                                                SHA1:67F290BF17859A900AB0227EE3703F2C5D409A47
                                                                                                                                                                                                SHA-256:1AFBCABBCD7A5C915D2BA33F45D4C9144A3B3249D06A0175118B2790B6D1E66E
                                                                                                                                                                                                SHA-512:F5EA048BF1C0C4AE491E7A6590ADF21F6B8317FFD6C361D0EE037DC679747582DAA7E8EFE8FF6225FF8BF2621CD47192DFE8A00E4A1BA74B0CDE324EC57B610F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352509227058513","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352509227058513","location":5,"ma

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4ceb6.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24853
                                                                                                                                                                                                Entropy (8bit):5.564953021574742
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:OCLrEbWodW5wQOf4aB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDvI8B+OrwXnpJtuR:OyIb7dWaQOfXBu1jaq1MLftu
                                                                                                                                                                                                MD5:590D8C7F13EA9202A1DBFEB28C128DFD
                                                                                                                                                                                                SHA1:67F290BF17859A900AB0227EE3703F2C5D409A47
                                                                                                                                                                                                SHA-256:1AFBCABBCD7A5C915D2BA33F45D4C9144A3B3249D06A0175118B2790B6D1E66E
                                                                                                                                                                                                SHA-512:F5EA048BF1C0C4AE491E7A6590ADF21F6B8317FFD6C361D0EE037DC679747582DAA7E8EFE8FF6225FF8BF2621CD47192DFE8A00E4A1BA74B0CDE324EC57B610F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352509227058513","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352509227058513","location":5,"ma

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):314
                                                                                                                                                                                                Entropy (8bit):4.816510591168781
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:chXUQI2xH8BzNmeH+IQYdxH8ajXBvLUxG3dIVP3IM/EU1C/:cyQI2xcBzNm97YdxcoXaG3el4sPY
                                                                                                                                                                                                MD5:C7F6310889D0397DC8EB1BB84D2BC2BD
                                                                                                                                                                                                SHA1:25652D44350EA57273A60BCDF12A63761D4BDF12
                                                                                                                                                                                                SHA-256:A1E9661A04440F2BEE42DB1B17B6FD63F3DA67991575B856E38BA4DFB32E526D
                                                                                                                                                                                                SHA-512:BBFC249F9B2F8988A8E44F1C9464FC65F59314A24CF3AF81679D8AD1B39F3E7DC2DE393AC5E474398C1BBFD6751560EB289A34232EE785095B33976707276D3C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"..x2................URES:1...INITDATA_NEXT_RESOURCE_ID.2....?................REG:https://www.youtube.com/.0..REGID_TO_ORIGIN:0...Z.................URES:1..URES:0..PRES:1...PRES:0...z..................PRES:1..U.................PRES:0

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):303
                                                                                                                                                                                                Entropy (8bit):5.156842324247343
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXvvp1N723oH+TcwtE/a252KLlgGfXo+q2PN723oH+TcwtE/a2ZIFUv:akhaYeb8xLCqvVaYeb8J2FUv
                                                                                                                                                                                                MD5:58D1B951580295841D8C1D67346E7EA1
                                                                                                                                                                                                SHA1:3DAA98604D740216BF7079A0A69279D1E4C8B875
                                                                                                                                                                                                SHA-256:D40F0836ADCB5F16DC37AE70237BA0B9E3183DA81741FC756E0E82E98B32F80E
                                                                                                                                                                                                SHA-512:CD2027EE891BE083823049425A5A5C488E9DAE38C8B8489501AFE2F1B6E007B1C0FAA550414F1A1F97B6335FE2B7BE9C5C57D2C70B68D331E517B67C6C33380E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:38.380 1d58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/02/15-23:20:38.396 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):41
                                                                                                                                                                                                Entropy (8bit):4.704993772857998
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16105
                                                                                                                                                                                                Entropy (8bit):6.312612552212521
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:1GUcHOqEcbuCp3bkQspksx5nJWJf27S25X/vk5bSxSGtOHu+JEYw:1GNH+AILpkst7bX/I8tBgw
                                                                                                                                                                                                MD5:48CFCD1C5316241FB5FBF028E19646AD
                                                                                                                                                                                                SHA1:4E2CEE241C2874143732AE4F40DAE280CC9ED6DF
                                                                                                                                                                                                SHA-256:37DC600A3FDBE50C78F23ABD157EB9DA04F72328205CE114B7429FD303D4C92A
                                                                                                                                                                                                SHA-512:731C5B2DB6E02925048F8EADBCA838E8FC9E9DD24EE2D910BDBC9128268395696C902895F4EA4C51F902039183663C6A1BBFCCEB11F67837E8830136AFC83AC0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:0\r..m..........rSG.....0/** 12272514873756138364 */self.document = self; self.window = self;var ytcfg={d:function(){return window.yt&&yt.config_||ytcfg.data_||(ytcfg.data_={})},get:function(k,o){return k in ytcfg.d()?ytcfg.d()[k]:o},set:function(){var a=arguments;if(a.length>1)ytcfg.d()[a[0]]=a[1];else{var k;for(k in a[0])ytcfg.d()[k]=a[0][k]}}};.ytcfg.set({"EXPERIMENT_FLAGS":{"H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"att_web_record_metrics":true,"clear_user_partitioned_ls":true,"compress_gel":true,"csi_config_handling_infra":true,"deprecate_csi_has_info":true,"disable_child_node_auto_formatted_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_use_scheduler":true,"enable_ab_report

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):10489
                                                                                                                                                                                                Entropy (8bit):5.808163854118032
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:Zz9jXxnfQ3O4CjbVT8xqfuF0xK8tfE4rKWeW1dvRKgu5a+DMvSRSxISSbmc:brxnfMWbVT8APfE4GzWTkgu5amMvqVbT
                                                                                                                                                                                                MD5:BAB7E257EFA90F8EEB5C37023DB5FD1F
                                                                                                                                                                                                SHA1:AB670B526C3081B3EC7CB7CCBD64F69756C21E89
                                                                                                                                                                                                SHA-256:0AB0982D6F4C3FFE3DC8F3564E05028C8F534E2CEE2F0F42F4A4846184897543
                                                                                                                                                                                                SHA-512:F0B9BFFB95B555B68D28B7407931CD442F13CD31FF4D8216B4B707A4188D4DF61BDC0418DCF886670562F49E16DFABB88B66B5D4D898C42245434C30B3CCDD37
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:0\r..m..........rSG.....0...../...............R..X....yT.(.......,T....`.....hL`0.....L`......Rcb.q.....ytcfg.....Rc.......policy...............$..a............C...C...C.,T.L.`V.....L`..........Rb.f......yt....RcB2W6....config_.....Rc.Y......data_......Dm............!...-.....!...-.....!...-.....!...~.2........$Sb................`....Da....0.......d..........`...P......H......,Q.(..b.....https://www.youtube.com/sw.js...a........Db............D`.......A.`............,T.L..`T.....L`..........Dm............!...-....]...r....!...-....]....../..........$Sb...............`....DaJ..........c..........@......<e..........................,T...`......L`................D~X..............-......n... !...-....]...../...../..4....A./...;v............-........!...-....]...../...../..4.....,.......$Sb...............`....Da......... ..f.........D......`.... ...\...e..........................,T.$.`......L`......R...4^.v...https://www.youtube.com/s/desktop/bdb59273/jsbin/serviceworker-kevlar-appshell.v

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):164879
                                                                                                                                                                                                Entropy (8bit):5.629715687251042
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:QvX5Lw5UlDJVZHL08oy6CiEETgDAGXoI7xuSrnCvnxtsmEtn4DtATIcT3PY0AP:QvX5LKUlDJVZHL08oyRiJsD7oIS/sHnC
                                                                                                                                                                                                MD5:1C99D2495C1B61907731B7A2A0353965
                                                                                                                                                                                                SHA1:3E25099E7CD91CAB7AB66DDDC6474C8291D4EBBF
                                                                                                                                                                                                SHA-256:31FDC65337F90BCA9A67066C8E3A17BF96C89FC77212EB0DAD711F48B25157F3
                                                                                                                                                                                                SHA-512:D33C83869406004AC4D90904342B2BFA88AF841D0AE9AECA74A160A3061C4FBFD7694150C9FC035AD81BA4BD082BA54D6C2E917B8E5B839FEA019E29B5CAA7CB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:0\r..m..........V.......1'use strict';var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ca=ba(this);function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}.function ea(a){function b(d){return a.next(d)}.function c(d){return a.throw(d)}.return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}.f(a.next())})}.function r(a){return ea(a())}.function fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:funct

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):398673
                                                                                                                                                                                                Entropy (8bit):6.10782194264741
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:BJ9+8VUsKtlvQ/Fj8TvsyNc7mFHCp8BPL1CIGkwO:BH+8VUssI8TvTLHt51Cxkl
                                                                                                                                                                                                MD5:F38CD2ED262D03BE82DF3FB9BA4A9255
                                                                                                                                                                                                SHA1:E2A7A4C8273983A9FB6494370664A31A1EE1264F
                                                                                                                                                                                                SHA-256:B0C1A90C4AC73B527ED904B7EE9C565EE03FD2950386FE139CBBCB83F7796F47
                                                                                                                                                                                                SHA-512:AD21C35EE0E471523AEDF7AF6C1F55E38FA9835EC971D6AA2EBFE7FE11ADEDA43FE5922D6D6BEFA145BE0CC6B8197290163D378A1E8FC4C106911A7FB17509D0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:0\r..m..........V.......1...../...............R......yT.........,T.11..` b.....L`X......L`......Rb..}7....aa...,T...`.....,L`.......}.`......Le...........................................r......(Rh...&....Cannot find global object......D.. ...........z..%...".. ...!..6........6......".. ...!..6......".. ...!..6......".. ...!..6........-...m...#../....-....!..k.........P..&..!......b..!..(Sb.............Rb........ba..`....Dax...n....1.Sb.`...............c..................Rb........Ud..`F.....Rb.lqx....Bo..`.....D..Rb"..H....Qc..`2.....Rb&..$....Bk..`.....D..Rb..O.....Cb..`.....D..Rb6(Rs....Nb..`......Rb:..-....Ab..`.....D..Rb6.......Zf..`f....D..RbJ..4....Wl..`......Rb6T......ug..`l....D..RbV.R.....Kf..`X.....RbZ..Q....Pj..`.....D..RbnL......Rj..`......Rbr.kT....Hl..`.....D..Rb~.m.....cb..`......Rb~.......$d..`H....D..Rb.L......Rd..`D....D..Rb.......dc..`".....D..Rb..Hw....Pg..`r....D..Rb..;....Km..`......D..Rb.. b....le..`L.....Rb..{.....Ub..` .....Rb........Qf..``.....Rb.......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:m+l:m
                                                                                                                                                                                                MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:0\r..m..................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                Entropy (8bit):3.576284505546377
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:E4ftAyq/6ldljf/tlWL6/tlvlz3J:E8tGit/GLuLJ
                                                                                                                                                                                                MD5:51EE640F53D15ECC1C5D2B975A0EC1B3
                                                                                                                                                                                                SHA1:B16B25A9BD8196B001002EE68723606E03A97564
                                                                                                                                                                                                SHA-256:BEBB2CB9936F3E3CA3A3E72B23ACE16D22A29B226EE3392BF54A0C34C54B871D
                                                                                                                                                                                                SHA-512:EB06F1C2640539910C35E6BC601745D5A9F00C2D2B59E9AA745D1FB7743D148E9D01A538DE6994715439A6501D7003BAB5D4FE3AF477E6275F975DAED2E6906D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:X.....0.oy retne........................5j.+y..L.................X....,`........h.........R.p/.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                Entropy (8bit):3.576284505546377
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:E4ftAyq/6ldljf/tlWL6/tlvlz3J:E8tGit/GLuLJ
                                                                                                                                                                                                MD5:51EE640F53D15ECC1C5D2B975A0EC1B3
                                                                                                                                                                                                SHA1:B16B25A9BD8196B001002EE68723606E03A97564
                                                                                                                                                                                                SHA-256:BEBB2CB9936F3E3CA3A3E72B23ACE16D22A29B226EE3392BF54A0C34C54B871D
                                                                                                                                                                                                SHA-512:EB06F1C2640539910C35E6BC601745D5A9F00C2D2B59E9AA745D1FB7743D148E9D01A538DE6994715439A6501D7003BAB5D4FE3AF477E6275F975DAED2E6906D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:X.....0.oy retne........................5j.+y..L.................X....,`........h.........R.p/.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF439e8.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                Entropy (8bit):3.576284505546377
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:E4ftAyq/6ldljf/tlWL6/tlvlz3J:E8tGit/GLuLJ
                                                                                                                                                                                                MD5:51EE640F53D15ECC1C5D2B975A0EC1B3
                                                                                                                                                                                                SHA1:B16B25A9BD8196B001002EE68723606E03A97564
                                                                                                                                                                                                SHA-256:BEBB2CB9936F3E3CA3A3E72B23ACE16D22A29B226EE3392BF54A0C34C54B871D
                                                                                                                                                                                                SHA-512:EB06F1C2640539910C35E6BC601745D5A9F00C2D2B59E9AA745D1FB7743D148E9D01A538DE6994715439A6501D7003BAB5D4FE3AF477E6275F975DAED2E6906D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:X.....0.oy retne........................5j.+y..L.................X....,`........h.........R.p/.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1434
                                                                                                                                                                                                Entropy (8bit):5.0027579467201635
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:Ra0ZZZZNoPY72hXMM0lo5R3UJ5z4s8oDx3vCJXnlJyGbfiJ:tZZZZNKYChJ6o5R65zc+x/ud+J
                                                                                                                                                                                                MD5:41471F5DC80F22068C277DC9867F043C
                                                                                                                                                                                                SHA1:BCE7DC1569A535E74ABE9F381323EC01A34FCB65
                                                                                                                                                                                                SHA-256:EB2677EF3706DA6E8E9ACB648949EB14E660F16A95C593A4D65B89AC2FE6852F
                                                                                                                                                                                                SHA-512:B43EE55D02219DF2559710BB791A95274C817D8FA2E849E06D78BD21DA34DA2676DF82CDF3989C96601E545FADB61CB2FEBE51587FF374E74669B445ECBD8A2D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............^<..f................next-map-id.1.Gnamespace-15a8f56e_06fb_4eb5_b906_db716d11856e-https://www.youtube.com/.0.n..j................next-map-id.2.Knamespace-15a8f56e_06fb_4eb5_b906_db716d11856e-https://accounts.google.com/.1.9ON.................map-0-__sak..b8.................b8.................b8.................b8..................7................!map-0-yt-remote-fast-check-periodb{.".d.a.t.a.".:.".1.7.0.8.0.3.5.9.6.7.4.2.4.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.8.0.3.5.6.6.7.4.2.4.}...map-0-yt-remote-session-appf{.".d.a.t.a.".:.".y.o.u.t.u.b.e.-.d.e.s.k.t.o.p.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.8.0.3.5.6.6.7.4.2.3.}...map-0-yt-remote-session-nameV{.".d.a.t.a.".:.".D.e.s.k.t.o.p.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.8.0.3.5.6.6.7.4.2.3.}...map-0-__sak..(.f................next-map-id.3.Gnamespace-e45c7471_16ad_44d9_b70a_dccd6664d097-https://www.youtube.com/.2."..g....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.135667957378121
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXeQyq2PN723oH+TcwtrQMxIFUt8XGfXWVpG1Zmw+XGfXWSjQRkwON723oH+Tv:ajQyvVaYebCFUt8XpVpg/+XpSjQR5Oan
                                                                                                                                                                                                MD5:2BBAF6EE869FA9296AA1E94356BDD1EB
                                                                                                                                                                                                SHA1:728B43575E4EA501558B06372EFC266B0B61A121
                                                                                                                                                                                                SHA-256:BF5431025007503D16D40BEC851565C99409522B91FCCD65EB4C61C328EB5DC0
                                                                                                                                                                                                SHA-512:53DD381F6DAFBE9DF9A39C17DCE7961E50C0872F6C7103CE0026268A4054C575B9A61CFBF717F2EFFDDE602E9E37F93CB7BAEFD45BF65B018ED37DE892B880BA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.959 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/02/15-23:20:28.962 2814 Recovering log #3.2024/02/15-23:20:28.967 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.135667957378121
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXeQyq2PN723oH+TcwtrQMxIFUt8XGfXWVpG1Zmw+XGfXWSjQRkwON723oH+Tv:ajQyvVaYebCFUt8XpVpg/+XpSjQR5Oan
                                                                                                                                                                                                MD5:2BBAF6EE869FA9296AA1E94356BDD1EB
                                                                                                                                                                                                SHA1:728B43575E4EA501558B06372EFC266B0B61A121
                                                                                                                                                                                                SHA-256:BF5431025007503D16D40BEC851565C99409522B91FCCD65EB4C61C328EB5DC0
                                                                                                                                                                                                SHA-512:53DD381F6DAFBE9DF9A39C17DCE7961E50C0872F6C7103CE0026268A4054C575B9A61CFBF717F2EFFDDE602E9E37F93CB7BAEFD45BF65B018ED37DE892B880BA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.959 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/02/15-23:20:28.962 2814 Recovering log #3.2024/02/15-23:20:28.967 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13352509229561937

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):49574
                                                                                                                                                                                                Entropy (8bit):3.5211148237986034
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:nK7XmPXq5rvQXq5rvgXq5rBZiGkePbi3OaGU43JGcH3xY43JGcH3x9kvr3JGcbUa:sY6E686UIOIBMM606
                                                                                                                                                                                                MD5:4BB1F1979498882EE1284E3243298E87
                                                                                                                                                                                                SHA1:D351287EB8307783D073EA4648C34DECC8A7018D
                                                                                                                                                                                                SHA-256:CBCFCFB7663FCF87920623D5F0708D3D04299034EB6C9F2C597FD470D188EF0F
                                                                                                                                                                                                SHA-512:FABF04B027FA39E04D3D59AC96D4824A7F4D98C5031C528A75F63B60DB700A6AF954EEB563E1FAE7A6FB75C640631CCB633922EC7B21FD8BCF776B98900AD3A5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SNSS........<!.............<!.......".<!.............<!.........<!.........<!.........<!.....!...<!.................................<!..<!.1..,....<!.$...15a8f56e_06fb_4eb5_b906_db716d11856e....<!.........<!.....UV..........<!.....<!.........................<!.....................5..0....<!.&...{46F3A197-DB49-410A-81B3-94975C835573}......<!............<!.........................<!.............<!.........https://www.youtube.com/....d...`...!...X...................................................................................................%...s...&...s...................................h...............................................8.......h.t.t.p.s.:././.w.w.w...y.o.u.t.u.b.e...c.o.m./.................................8.......0.......8....................................................................... .......................................................P...$...5.2.1.1.9.d.3.9.-.0.d.9.0.-.4.f.f.b.-.b.6.2.9.-.a.c.b.7.c.5.6.d.e.2.5.0.................P...$...6.c.3.f.8.9.5.d.-.6.a

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                Entropy (8bit):0.44194574462308833
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                                                                                                                                                                MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                                                                                                                                                                SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                                                                                                                                                                SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                                                                                                                                                                SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.077892913305366
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQQN4q2PN723oH+Tcwt7Uh2ghZIFUt8XGfXQI8JZmw+XGfXQaDkwON723oH+Q:aaN4vVaYebIhHh2FUt8XO8J/+XsD5Oa0
                                                                                                                                                                                                MD5:29EECFC23218EB402B39177AF913A890
                                                                                                                                                                                                SHA1:FE50AA5AF5D254AD7D2358F18DC0ECDA2C9D5CCC
                                                                                                                                                                                                SHA-256:8AA569526A389F6066A293BBA76AE57DD6934E14CDDF4FE3183FE29540F17B55
                                                                                                                                                                                                SHA-512:D93AE10731BAAEE6764EE17694A5B26CC85426716D7B7C3D46F88243E49721A1D1F9B56ADB06BA197E0BC29BAB2CE0DE9A99AF3A96983B15E333F796243EDF89
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.224 2474 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/02/15-23:20:27.229 2474 Recovering log #3.2024/02/15-23:20:27.233 2474 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                Entropy (8bit):5.077892913305366
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQQN4q2PN723oH+Tcwt7Uh2ghZIFUt8XGfXQI8JZmw+XGfXQaDkwON723oH+Q:aaN4vVaYebIhHh2FUt8XO8J/+XsD5Oa0
                                                                                                                                                                                                MD5:29EECFC23218EB402B39177AF913A890
                                                                                                                                                                                                SHA1:FE50AA5AF5D254AD7D2358F18DC0ECDA2C9D5CCC
                                                                                                                                                                                                SHA-256:8AA569526A389F6066A293BBA76AE57DD6934E14CDDF4FE3183FE29540F17B55
                                                                                                                                                                                                SHA-512:D93AE10731BAAEE6764EE17694A5B26CC85426716D7B7C3D46F88243E49721A1D1F9B56ADB06BA197E0BC29BAB2CE0DE9A99AF3A96983B15E333F796243EDF89
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.224 2474 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/02/15-23:20:27.229 2474 Recovering log #3.2024/02/15-23:20:27.233 2474 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):270336
                                                                                                                                                                                                Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):270336
                                                                                                                                                                                                Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):438
                                                                                                                                                                                                Entropy (8bit):5.206642119113325
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:afw5QyvVaYebvqBQFUt8XfHrg/+XfzrQR5OaYebvqBvJ:af6QYVaYebvZg8XfLJfvQDOaYebvk
                                                                                                                                                                                                MD5:FF3BC3C7F592D7E301893FAC2E98427C
                                                                                                                                                                                                SHA1:C3601F4A657AFA312A2846D177565C1BB2231601
                                                                                                                                                                                                SHA-256:A5B4B83B3F42436CB7A33C050E1989D611DBB76058B43ABAA7D3AB70188E8E63
                                                                                                                                                                                                SHA-512:7A4D7BB0A7A9299EECEBA1FDB49D22AA61720CA852068BBC7D1D95B94DED5AC1F060D19EB551F5918493AE40CBF7A5760BC261F20E646E065E4E6DF106B82E69
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:29.014 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/02/15-23:20:29.019 2814 Recovering log #3.2024/02/15-23:20:29.051 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):438
                                                                                                                                                                                                Entropy (8bit):5.206642119113325
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:afw5QyvVaYebvqBQFUt8XfHrg/+XfzrQR5OaYebvqBvJ:af6QYVaYebvZg8XfLJfvQDOaYebvk
                                                                                                                                                                                                MD5:FF3BC3C7F592D7E301893FAC2E98427C
                                                                                                                                                                                                SHA1:C3601F4A657AFA312A2846D177565C1BB2231601
                                                                                                                                                                                                SHA-256:A5B4B83B3F42436CB7A33C050E1989D611DBB76058B43ABAA7D3AB70188E8E63
                                                                                                                                                                                                SHA-512:7A4D7BB0A7A9299EECEBA1FDB49D22AA61720CA852068BBC7D1D95B94DED5AC1F060D19EB551F5918493AE40CBF7A5760BC261F20E646E065E4E6DF106B82E69
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:29.014 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/02/15-23:20:29.019 2814 Recovering log #3.2024/02/15-23:20:29.051 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1ff7735a-3fc2-4ec1-9f5c-026aaa220ef6.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3cd18307-12e9-476f-bc06-097ef28bd85f.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5433d9dc-7630-47a7-b9db-456a8d9edb54.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):111
                                                                                                                                                                                                Entropy (8bit):4.718418993774295
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
                                                                                                                                                                                                MD5:807419CA9A4734FEAF8D8563A003B048
                                                                                                                                                                                                SHA1:A723C7D60A65886FFA068711F1E900CCC85922A6
                                                                                                                                                                                                SHA-256:AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
                                                                                                                                                                                                SHA-512:F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):36864
                                                                                                                                                                                                Entropy (8bit):0.3886039372934488
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
                                                                                                                                                                                                MD5:DEA619BA33775B1BAEEC7B32110CB3BD
                                                                                                                                                                                                SHA1:949B8246021D004B2E772742D34B2FC8863E1AAA
                                                                                                                                                                                                SHA-256:3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
                                                                                                                                                                                                SHA-512:7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):80
                                                                                                                                                                                                Entropy (8bit):3.4921535629071894
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                                                                                                                                MD5:69449520FD9C139C534E2970342C6BD8
                                                                                                                                                                                                SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                                                                                                                                SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                                                                                                                                SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):426
                                                                                                                                                                                                Entropy (8bit):5.227969979579344
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:abtQyvVaYebvqBZFUt8Xb6g/+XjjQR5OaYebvqBaJ:abtQYVaYebvyg8Xb6JjjQDOaYebvL
                                                                                                                                                                                                MD5:03839DF1497A75E68E908E82F49DDCE3
                                                                                                                                                                                                SHA1:F548859C1230FFD4CC854CF799BCBC19435B015E
                                                                                                                                                                                                SHA-256:C83774DDA6E71E8CB8C92B69D119BBB4EE7E1C879AED256A6056E98B94F08418
                                                                                                                                                                                                SHA-512:BDC295ACB4197630A5F29A3ADCD67F454BDABBA8B69A0046823D0AB325D2896421ABB8C1225E2008ADE7CD49714F643A8EE8271AEDE2428840623D501B17AF41
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:45.734 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/02/15-23:20:45.737 2814 Recovering log #3.2024/02/15-23:20:45.747 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):426
                                                                                                                                                                                                Entropy (8bit):5.227969979579344
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:abtQyvVaYebvqBZFUt8Xb6g/+XjjQR5OaYebvqBaJ:abtQYVaYebvyg8Xb6JjjQDOaYebvL
                                                                                                                                                                                                MD5:03839DF1497A75E68E908E82F49DDCE3
                                                                                                                                                                                                SHA1:F548859C1230FFD4CC854CF799BCBC19435B015E
                                                                                                                                                                                                SHA-256:C83774DDA6E71E8CB8C92B69D119BBB4EE7E1C879AED256A6056E98B94F08418
                                                                                                                                                                                                SHA-512:BDC295ACB4197630A5F29A3ADCD67F454BDABBA8B69A0046823D0AB325D2896421ABB8C1225E2008ADE7CD49714F643A8EE8271AEDE2428840623D501B17AF41
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:45.734 2814 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/02/15-23:20:45.737 2814 Recovering log #3.2024/02/15-23:20:45.747 2814 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):332
                                                                                                                                                                                                Entropy (8bit):5.13710083093461
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQJCL+q2PN723oH+TcwtpIFUt8XGfXQFiJKWZmw+XGfXQqLVkwON723oH+TcM:anm+vVaYebmFUt8XriJKW/+XwV5OaYev
                                                                                                                                                                                                MD5:3C9281401D7D3627D58ED8E988CB22BC
                                                                                                                                                                                                SHA1:FF32371FCB7B422C04A09A4860ACC90B55570643
                                                                                                                                                                                                SHA-256:7E217705C22D3B57D308C813C0A3D9CB0D5A7578C087691589709B0C4B5C006F
                                                                                                                                                                                                SHA-512:26724456905CEEB619D5D37684318BDAB4CE66FAF8504E742B1F6B7A97D41E9BAD44C261677C43280979E3D4FF3FCCD9C7ACD11D3A909A621EF504D0DE2D71CD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.145 25ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/02/15-23:20:27.149 25ec Recovering log #3.2024/02/15-23:20:27.150 25ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):332
                                                                                                                                                                                                Entropy (8bit):5.13710083093461
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXQJCL+q2PN723oH+TcwtpIFUt8XGfXQFiJKWZmw+XGfXQqLVkwON723oH+TcM:anm+vVaYebmFUt8XriJKW/+XwV5OaYev
                                                                                                                                                                                                MD5:3C9281401D7D3627D58ED8E988CB22BC
                                                                                                                                                                                                SHA1:FF32371FCB7B422C04A09A4860ACC90B55570643
                                                                                                                                                                                                SHA-256:7E217705C22D3B57D308C813C0A3D9CB0D5A7578C087691589709B0C4B5C006F
                                                                                                                                                                                                SHA-512:26724456905CEEB619D5D37684318BDAB4CE66FAF8504E742B1F6B7A97D41E9BAD44C261677C43280979E3D4FF3FCCD9C7ACD11D3A909A621EF504D0DE2D71CD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:27.145 25ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/02/15-23:20:27.149 25ec Recovering log #3.2024/02/15-23:20:27.150 25ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):131072
                                                                                                                                                                                                Entropy (8bit):0.008928756231971898
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:ImtVn7OOlJgz6Llll/lVVl1XpIXlraoBtY/llbr:IiV7lxlPIl+t/llb
                                                                                                                                                                                                MD5:883C159BB15F833A2B831900CBDF7CC6
                                                                                                                                                                                                SHA1:9F887DB0EBFB304B977E3181C25D8575E3C8068E
                                                                                                                                                                                                SHA-256:12C571577D73A518C7D51357B6880A9DE6295CF0A266C87BDAFFD9B96623659A
                                                                                                                                                                                                SHA-512:01AC366E831700F4892A158DF37A04226CD5373ECB1638B27D6F31E767AB74F7907FE7675F0C6043278B9FC999CC54C92BA7ECE613C08E1CAD60747858D4B8DF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:VLnk.....?........A..Z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 92, cookie 0x37, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                Entropy (8bit):1.281462973940201
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:6/2qOB1nxCkBSA1LyKOMq+8iP5GDHP/0jMVumAy:Pq+n0K91LyKOMq+8iP5GLP/0Vy
                                                                                                                                                                                                MD5:95079A2D0F4B6791AF4817EEF96816EC
                                                                                                                                                                                                SHA1:CAD7E42F182546B5F44E2C5BB14512E9564BE6A6
                                                                                                                                                                                                SHA-256:65F0C6990117615C86A5B7574E018AA6AC1D93E0BEB7CF1E6DD8D75258EC3A3F
                                                                                                                                                                                                SHA-512:26420963542EA25DC5C08AF92FBECB3D6E2FCDC422F738F5057AFF60A3F596BAC31DE0F5C0D7AD7EE45C507622C2B2208FCBA39E27204517DA4B2D326381E1AB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......\...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                Entropy (8bit):0.47051947174599246
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBg3AFA:v7doKsKuKZKlZNmu46yjxg3AFA
                                                                                                                                                                                                MD5:4931940BEAB8AC184129ADB9A0A338E5
                                                                                                                                                                                                SHA1:E036302F48A2D8859D5BD07FADCC6085239E9C8B
                                                                                                                                                                                                SHA-256:59C54112200AC31E1320165455F96D4657C974E62C1E5FCF14D914D9F7A65941
                                                                                                                                                                                                SHA-512:EEE265D01E7685CB9FEA67B25F16F1CC8CFDF98B976105D292D1109D6C91A401866D649746CF7BBA90661EA7F4768400F33334ADB512C9DBCBF6E677FD02CD41
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8720
                                                                                                                                                                                                Entropy (8bit):0.17368790312541135
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:/dlHNllHXtXlTAwpo/+hg/r/DSLUxGTKSS4UxGTkQfODBHQ:l9lvoN2LUxGFdUxGOS
                                                                                                                                                                                                MD5:F58E5ACD0583D2F884AF42B6BA207D7A
                                                                                                                                                                                                SHA1:8EEBD8E667DEDE5886E708AD847BDAFE338B4017
                                                                                                                                                                                                SHA-256:1D5ADE084552626A6F8A08035DF3C6C23C8D8215182B664F53318E3F179F594D
                                                                                                                                                                                                SHA-512:66A3A6E886210C4D0AE6A9772D8515E89447131258C18EF0AE43CE5E73D7E8B3726C52095674D5A0D4D8529CB61B06223DC1FE72B4A25D1638A1ABA5F2AB4440
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............?...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):11755
                                                                                                                                                                                                Entropy (8bit):5.190465908239046
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                                                                                                                                MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                                                                                                                                SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                                                                                                                                SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                                                                                                                                SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bc2c7ce6-fd9a-49cd-8ac8-85aac6701be6.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):14250
                                                                                                                                                                                                Entropy (8bit):5.2293935544979915
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttJ99QTryDiooSabatSuyhsvbaFvrE9kkN3r8JbV+FCZ7/7NpwaqU2PHjJ:sttPGoZSu+svbCDDbGCFTHwiC
                                                                                                                                                                                                MD5:F02843DA5FCA2E46E2C6733711E0A019
                                                                                                                                                                                                SHA1:ECE9CE767B73286518216570B178B57B5F9B2877
                                                                                                                                                                                                SHA-256:1912958829BB6DA9FDCD5EA1D80EDD279789CF88627DC2D7EA13291A028B65A4
                                                                                                                                                                                                SHA-512:6BA901B57AB6D7C793BC7270E4CB1CEA2BCA8F84D9D260904FD1AF1D12647506D76C2C2A3FB499AB65958BEFD8287C7822A09F3053BDFE900896391F9E63CED7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c3b7e085-c88a-48e5-ab5f-b8127e5d291e.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):25186
                                                                                                                                                                                                Entropy (8bit):5.57072266407114
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:OCLrEbWBdW5wQOf45B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPgvI8B+OrwXBpJtur:OyIb8dWaQOfuBu1jaT1MLRtI
                                                                                                                                                                                                MD5:A5C96FEC266A0A8B826A12EE721F7241
                                                                                                                                                                                                SHA1:53FD896850AD27C8846627BBAF9CAB6D1F89B9DF
                                                                                                                                                                                                SHA-256:08761B78D17382C38198186BEE75DA2CFC11271185BF5C2698C6F472A931FC91
                                                                                                                                                                                                SHA-512:8F8D7728B3FFED564C0072766FA376DF4A0C9919BAF79281BB102A3E33E45637B14A03A4E4D7F50499F1B276F01701938A1C7E18C3DF9CD0FEA698894EC5BDAB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352509227058513","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352509227058513","location":5,"ma

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                Entropy (8bit):0.3410017321959524
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                                                                                                                                                                MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                                                                                                                                                                SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                                                                                                                                                                SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                                                                                                                                                                SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\de1a562f-8ae4-4f11-8858-bf4bb451484a.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:L:L
                                                                                                                                                                                                MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e8ea3978-5a93-4675-84da-90160b02c847.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24853
                                                                                                                                                                                                Entropy (8bit):5.564953021574742
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:OCLrEbWodW5wQOf4aB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPDvI8B+OrwXnpJtuR:OyIb7dWaQOfXBu1jaq1MLftu
                                                                                                                                                                                                MD5:590D8C7F13EA9202A1DBFEB28C128DFD
                                                                                                                                                                                                SHA1:67F290BF17859A900AB0227EE3703F2C5D409A47
                                                                                                                                                                                                SHA-256:1AFBCABBCD7A5C915D2BA33F45D4C9144A3B3249D06A0175118B2790B6D1E66E
                                                                                                                                                                                                SHA-512:F5EA048BF1C0C4AE491E7A6590ADF21F6B8317FFD6C361D0EE037DC679747582DAA7E8EFE8FF6225FF8BF2621CD47192DFE8A00E4A1BA74B0CDE324EC57B610F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352509227058513","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352509227058513","location":5,"ma

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f0ce6e43-b924-413a-8ded-66dae4903d12.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12459
                                                                                                                                                                                                Entropy (8bit):5.204935169219039
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:sttJ99QTryDigabatSuyhsvbaFvrE9kjN3r8WbV+F5UQaAU2PHYJ:sttPGKSu+svbCDHbGyQ+D
                                                                                                                                                                                                MD5:A008019C1890420944603E0C8E66129B
                                                                                                                                                                                                SHA1:247EC4741D2AE941C57F63A6918F3B05AE5C2DB9
                                                                                                                                                                                                SHA-256:3A1BAC4438C616F7D2B2B0D849B9D0FEA2494B7EFB232662D9111FA11FA6F011
                                                                                                                                                                                                SHA-512:7BC44B3858887BA6B7EB26EF07490C4735D7EE4297B08B62F39F98B6A4A02C156749C2986D06D79D036146088FA4B3385E02BA400C50FE840DA8BD390CFD2C68
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352509228173754","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f8a5ce0a-d5b8-4010-b89d-5d7dd10746e6.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):35446
                                                                                                                                                                                                Entropy (8bit):5.557973576824114
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:OCKrmbWQdW5wQOf47B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPfvI8BZOrwXJ7sJqt:O/abBdWaQOfcBu1jaY1zLZ7soQt+
                                                                                                                                                                                                MD5:CD65BC848A36251E00DBBC59B72421C7
                                                                                                                                                                                                SHA1:1D7421B29E40E06AE199C4961F2010D98CACF9AB
                                                                                                                                                                                                SHA-256:F9C54380837CD7F127EF867C2ECF6BF4B816E818897636AB885E4DDE02074FC4
                                                                                                                                                                                                SHA-512:3E7CE34DFFD21BEFDBE046759F2FC3EB3BC3FB314BD25DEE7C51357A9EB25536A1ABE38AC544095E4607FC717E0CD8BA694097DC45CFA72CB327B539CD34A034
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352509227058513","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352509227058513","location":5,"ma

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 15, database pages 22, cookie 0x7, schema 4, UTF-8, version-valid-for 15
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):90112
                                                                                                                                                                                                Entropy (8bit):4.326387810739258
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:glu3GMvHvI6bO1Sc6GHlo7dATZocchnTcEJaczgP8rRINpAUedBFYO7LcLuEAxNN:Qu3GacTHlk9TLDrR0iUYb7LcyhADsE4J
                                                                                                                                                                                                MD5:0E07B5C1A764B4329146A1A115D0B6A5
                                                                                                                                                                                                SHA1:F3246301B9FC66E194C7923079E469B3525C9AF6
                                                                                                                                                                                                SHA-256:3CDAAB0FA16DB361226AA60D6394D398DF7FCBC9590CDF3B0BA22A793648EB7B
                                                                                                                                                                                                SHA-512:0A1A0D9E411D0586EF419528A2179BF11EB902956B1BCEBCBE29E6E8672E38CFE4491DD9CA686BD256E3EDAF936ED4B247F1CCD93B2345D4AA178A1FE53BACC4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.155983690325852
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:4L8GL8lil9l9l9l9lsTl/ul/V6CGZ5LlEjcitVr8lodlbwFEaUw:4L8hGHHHHsTcBGZllEpxRn0
                                                                                                                                                                                                MD5:AA24D5D9378D044A3216C047FF780C5F
                                                                                                                                                                                                SHA1:CAD8ABA01049ACAD0907EAF4A574CFB21515F02B
                                                                                                                                                                                                SHA-256:A31556292E6E65340C406F6D9D5BF1C8F3F3089596DDEE0F11AE43184DE83268
                                                                                                                                                                                                SHA-512:5B6C201E970B50970BAF98CC1187A52031F44ACBC64CF62C7EB328422CC6ACF3E1BFED32CBEC3944301A024718506995187573162C3CBAD6F4B607B23DAED4BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-........................7..$J.."..<...U.f...-........................7..$J.."..<...U.f.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4128272
                                                                                                                                                                                                Entropy (8bit):5.1306857785923405
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:jxqqupsdvIt+ac772hCvhKywq0Oa07/2J/+584Gzh63hBEhZvhtdhQPhe/h/mh2d:M
                                                                                                                                                                                                MD5:D8A1EC15CE6E75CCEC61AB5FED6F3BAF
                                                                                                                                                                                                SHA1:B57E56E5A5154A3B1039BE2BC34A9C8470B89A93
                                                                                                                                                                                                SHA-256:CE57B8CCC88FFDF866527D30CC2A50B766956E4A026A9E542213D9FCECE814D8
                                                                                                                                                                                                SHA-512:CFDC59DB9A1FDF68F85D19DF54F45715D6A4DE6C949365877982D099B1D478615403BD0F9E5A7B88339493DE9C10C7C4EC438EB9B8D070D468CADCAEB4EA3191
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:7....-..........$J.."..<..M7.*3.........$J.."..<..P..g........x........r.e.K.>.1.$.......................n.a.T.G.:.-. .........................w.j.].P.C.6.)...........................s.f.Y.L.?.2.%.........................|.o.b.U.H.;...!.........................x.k.^.Q.D.7.*.......................r.d.V.....H...:...,.........................v.h.Z.L.>.0.".......................z.l.^.P.B.4.&.......................~.p.b.T.F.8.*.........................t.f.X.J.<... .......................x................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):611
                                                                                                                                                                                                Entropy (8bit):2.85777528127404
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuuu:pHay
                                                                                                                                                                                                MD5:CDD8374D5568E8BFC1E95134491EF19D
                                                                                                                                                                                                SHA1:095CD208AAC544778359EE3109A2E5C5CA215F67
                                                                                                                                                                                                SHA-256:C5D34A2A6E83159EBC3BA756722020769E44DF790E4B76C5A7468446D6C86700
                                                                                                                                                                                                SHA-512:CFB9C56EF5271F58AA773A790F88CB702272CA94750E68152B8E0935EE400599CF3C1AC66FAEDD6833F28922EB7391A1FA5C032C94AAAF6FA56F19CD079C58D0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.198267343419408
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXdt+q2PN723oH+TcwtfrK+IFUt8XGfXuZmw+XGfX3fVkwON723oH+TcwtfrUQ:aQovVaYeb23FUt8X5/+XUN5OaYeb3J
                                                                                                                                                                                                MD5:1B3893337C72CCD2A92CC6D2DE7867E7
                                                                                                                                                                                                SHA1:4628B28CB629274364C685EE97724A78A9150B39
                                                                                                                                                                                                SHA-256:9A5E479E6525F77E339EF3F8F149350CE45E02D5EA7A6F2B797A03A9F516A77D
                                                                                                                                                                                                SHA-512:80CED784C217DD2C297888E6920AF905E67B3689D2F69336034E807618FFB68901C7E6FEE6AC9069CBFFE7AF8F4568D6C79F9EC31771D9CB83E5CE13B3C18956
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.286 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/02/15-23:20:28.289 1d58 Recovering log #3.2024/02/15-23:20:28.295 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):5.198267343419408
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXdt+q2PN723oH+TcwtfrK+IFUt8XGfXuZmw+XGfX3fVkwON723oH+TcwtfrUQ:aQovVaYeb23FUt8X5/+XUN5OaYeb3J
                                                                                                                                                                                                MD5:1B3893337C72CCD2A92CC6D2DE7867E7
                                                                                                                                                                                                SHA1:4628B28CB629274364C685EE97724A78A9150B39
                                                                                                                                                                                                SHA-256:9A5E479E6525F77E339EF3F8F149350CE45E02D5EA7A6F2B797A03A9F516A77D
                                                                                                                                                                                                SHA-512:80CED784C217DD2C297888E6920AF905E67B3689D2F69336034E807618FFB68901C7E6FEE6AC9069CBFFE7AF8F4568D6C79F9EC31771D9CB83E5CE13B3C18956
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.286 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/02/15-23:20:28.289 1d58 Recovering log #3.2024/02/15-23:20:28.295 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):816
                                                                                                                                                                                                Entropy (8bit):4.0647916882227655
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
                                                                                                                                                                                                MD5:3BE72D8D40752B3A97028FDB2931FABA
                                                                                                                                                                                                SHA1:A27EA4726857A948F0A4B074062B674469A9A371
                                                                                                                                                                                                SHA-256:3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
                                                                                                                                                                                                SHA-512:8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):346
                                                                                                                                                                                                Entropy (8bit):5.1863623485670125
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXx3+q2PN723oH+TcwtfrzAdIFUt8XGfXHZmw+XGfXnVkwON723oH+TcwtfrzS:amOvVaYeb9FUt8Xg/+X45OaYeb2J
                                                                                                                                                                                                MD5:03C035F428268844F8AB3C79306729EC
                                                                                                                                                                                                SHA1:E272CBA5DA869F97571988DB8FBE2C72E25DD955
                                                                                                                                                                                                SHA-256:C44278412A14DCD4539D1D39133AE2577775C06236370FA92AD7C08D8BBA1FB2
                                                                                                                                                                                                SHA-512:7D26EE4C0B6F4859904BBEC63ACB7AAA23F70F3EA7269048E80FCA8C5C84148328FCFABD9D5BF8CC97122E8AEF35D57283337EC70EE7427D3765749EF8B5920A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.257 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/02/15-23:20:28.259 1d58 Recovering log #3.2024/02/15-23:20:28.260 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):346
                                                                                                                                                                                                Entropy (8bit):5.1863623485670125
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:aGfXx3+q2PN723oH+TcwtfrzAdIFUt8XGfXHZmw+XGfXnVkwON723oH+TcwtfrzS:amOvVaYeb9FUt8Xg/+X45OaYeb2J
                                                                                                                                                                                                MD5:03C035F428268844F8AB3C79306729EC
                                                                                                                                                                                                SHA1:E272CBA5DA869F97571988DB8FBE2C72E25DD955
                                                                                                                                                                                                SHA-256:C44278412A14DCD4539D1D39133AE2577775C06236370FA92AD7C08D8BBA1FB2
                                                                                                                                                                                                SHA-512:7D26EE4C0B6F4859904BBEC63ACB7AAA23F70F3EA7269048E80FCA8C5C84148328FCFABD9D5BF8CC97122E8AEF35D57283337EC70EE7427D3765749EF8B5920A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:2024/02/15-23:20:28.257 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/02/15-23:20:28.259 1d58 Recovering log #3.2024/02/15-23:20:28.260 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):120
                                                                                                                                                                                                Entropy (8bit):3.32524464792714
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                                                                                                                                MD5:A397E5983D4A1619E36143B4D804B870
                                                                                                                                                                                                SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                                                                                                                                SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                                                                                                                                SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):13
                                                                                                                                                                                                Entropy (8bit):2.6612262562697895
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:NYLFRQZ:ap2Z
                                                                                                                                                                                                MD5:B64BD80D877645C2DD14265B1A856F8A
                                                                                                                                                                                                SHA1:F7379E1A6F8CE062E891C56736C789C7EA77CD6A
                                                                                                                                                                                                SHA-256:83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
                                                                                                                                                                                                SHA-512:734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:117.0.2045.55

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38cb1.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38d2e.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38d3d.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38ee3.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38f22.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38f31.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39099.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF390a8.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3978e.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bd94.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4052c.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF45466.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ceb6.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d619.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d8c8.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ff2c.TMP (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44455
                                                                                                                                                                                                Entropy (8bit):6.089774305986425
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMykzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1pkzItSmd6qE7lFoC
                                                                                                                                                                                                MD5:8D55BE6093CB4C737B573FA98BCD0488
                                                                                                                                                                                                SHA1:24EADD8653BF50598C44E4EC4D08D049CAC633CF
                                                                                                                                                                                                SHA-256:DB30214AAA2DCB44B56345077BD6EE2F014E81B288B6C6FAA39B1CFF25FB7219
                                                                                                                                                                                                SHA-512:150F1EF134A68BBD77151556CF128801DEFD5FF6DEFEE8473ACC6E3F7EF69386FB2388212033854629E107EBE2DA4E2581696CFDEA2047227AD644BEE8A16D27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                Entropy (8bit):0.5951162566636528
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isx0zydgXzVd4Ux5zvSY:TLyXOUOq0afDdWec9sJfj7s7J5fc
                                                                                                                                                                                                MD5:96D57C5C7DB83B712F2693EAB2AFFEA8
                                                                                                                                                                                                SHA1:67D588EB0AD1E1D3A0F28143005137E7722EF756
                                                                                                                                                                                                SHA-256:BA339F7DA3E246FE52B640E44F5F699E181CD818F79845CB7E485CE7DE41EE18
                                                                                                                                                                                                SHA-512:EA1C0D06FE4A63BC913686D88BF6B55413DEC35B1894B9835E14F8517460CDDECC499DFE386C8D4FB53205A227D2F757D505FC343C1F05CF0162FC8595A992E5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):47
                                                                                                                                                                                                Entropy (8bit):4.3818353308528755
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                                                                                                                                MD5:48324111147DECC23AC222A361873FC5
                                                                                                                                                                                                SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                                                                                                                                SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                                                                                                                                SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):35
                                                                                                                                                                                                Entropy (8bit):4.014438730983427
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                                                                                                                                MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                                                                                                                                SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                                                                                                                                SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                                                                                                                                SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"forceServiceDetermination":false}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):50
                                                                                                                                                                                                Entropy (8bit):3.9904355005135823
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                                                                                                                                                                MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                                                                                                                                                                SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                                                                                                                                                                SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                                                                                                                                                                SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):575056
                                                                                                                                                                                                Entropy (8bit):7.999649474060713
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                                                                                                                                MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                                                                                                                                SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                                                                                                                                SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                                                                                                                                SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):86
                                                                                                                                                                                                Entropy (8bit):4.3751917412896075
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
                                                                                                                                                                                                MD5:F732DBED9289177D15E236D0F8F2DDD3
                                                                                                                                                                                                SHA1:53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
                                                                                                                                                                                                SHA-256:2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
                                                                                                                                                                                                SHA-512:B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b8baeb06-9c94-4989-94ad-20f428686a66.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45804
                                                                                                                                                                                                Entropy (8bit):6.09298185356255
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:LDXzgWPsj/qlGJqIY8GB4xKXs8i1zNtd450QE99kDzFmjyAKJDSgzMMd6qD47u3/:L/Ps+wsI7yOKA4bEFKtSmd6qE7lFov
                                                                                                                                                                                                MD5:2FF1E239C58C290D6C3B634BB4A3750D
                                                                                                                                                                                                SHA1:5D921CB3AB1C9E64C08BF48F0F8453C00210DAD9
                                                                                                                                                                                                SHA-256:DAEE9794582971184F0E59D4F0C1EDFB2539852FC5602EABFB0770229E045D29
                                                                                                                                                                                                SHA-512:033E2426B5080594B0CCEFB6E151CEBA9E5FA96CF482F0B36D511E5094FD9F74C8F86C92C7FF0D7CF28B3CB7B5090E354CD4F58180EE2F83121DC600BEDD1ED4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"EAD2F7F304438EAE4EE2A4A824C7D0ADEE7DD839BDE627B460B259EDF643904C\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bd28132b-f4cc-458e-9f56-84e356f18106.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):45881
                                                                                                                                                                                                Entropy (8bit):6.092937625730468
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:LDXzgWPsj/qlGJqIY8GB49KXbgi1zNtd450QE69kDzFmjyAKJDSgzMMd6qD47u3/:L/Ps+wsI7yAKN4bEKKtSmd6qE7lFov
                                                                                                                                                                                                MD5:7DB0C317C548C8A4C4BA94F5CB4646FA
                                                                                                                                                                                                SHA1:5E5EA5F3222F979B6BA1E4836D3553C2160D8DB9
                                                                                                                                                                                                SHA-256:542AC628F751972E96467B4A0E56629C5BA9766349A526B1578C38B8D48E0DCB
                                                                                                                                                                                                SHA-512:F51C662145BA7EACC0E08B841AE8A122CE405FBC577BB5AC9F3D4D841F0F7F3511FB613EDDE7472172CBFCA24641CF4AA9EB2794A2CB4CCFCEE6B6B2B6F41062
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"EAD2F7F304438EAE4EE2A4A824C7D0ADEE7DD839BDE627B460B259EDF643904C\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cd0e7b49-7aa0-4093-95f0-4f065dc0947f.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44954
                                                                                                                                                                                                Entropy (8bit):6.095672579117706
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4xWZpi1zNtd450QE99kDzFmjyAKJDSgzMMd6qD47u3+7:+/Ps+wsI7yO94bEFKtSmd6qE7lFoC
                                                                                                                                                                                                MD5:B6D98AE409A5FD06AFD0913F07E52738
                                                                                                                                                                                                SHA1:F6BDA370DD1E2757214E11D074CFEA704C44AA83
                                                                                                                                                                                                SHA-256:868F0B3415AD5ABD2807D2B9B31AE11F8632CA5225A6017F1763A4019E707167
                                                                                                                                                                                                SHA-512:D9FDFC94307E2713E01EB21FDC0147FC0ABF0C2E4E4E385E98281930011C6EB91AC3874F2B07684D729ACAEE89D0258BCBED751E40CF323B4D070D3A558627C7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ce1c029c-f8e6-4232-bb58-108af213c465.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):56417
                                                                                                                                                                                                Entropy (8bit):6.099732765948035
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:DNLUfxfjlIdQD5KN4bEKyUa5wFogtSmd6qE7m:GpjlEc5IltUaAx8Tm
                                                                                                                                                                                                MD5:6570D597503B15497F994180E7390B10
                                                                                                                                                                                                SHA1:540D67F25AC69125E794AB38ED4841216785DE2E
                                                                                                                                                                                                SHA-256:EED92D8874F3E73A8BAFCCA6B3D44128CBE5D3E4E30A8447749CFEDC46A77EC6
                                                                                                                                                                                                SHA-512:ED652F18695D0B0BBD952169849238545D7123FBA84E891A1A6570B3FA84DB62C1B28A56F07B03BF8A7BD8D761DC8C7EF175587599AA7A19447DC566AC02AC7F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"EAD2F7F304438EAE4EE2A4A824C7D0ADEE7DD839BDE627B460B259EDF643904C\"","apps_count_check_time":"13352509228436640","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAO19WZMjt5HwX5noJ9shoqd7Lo33SSvLR9iyHLIcivg2HB0oAKxCFwqoxkGy6PB/30wU2cewCmRWa/fl2weNutlMnIm8j39dfWOl857/45sfNsp7LdXVb/91xfveaMGjdjZc/fa//vnVVe/gA63wt39dWd7B166+k7X6xzdXX13Focffe+6j5uZH1RsuVKdshL9tuEn4x29gSPWzqv6s4/WHd5/Yu49vfvXnP/70/V++emN0q978QYnW/frNt413nbr+9Ja9Ze8+vPua3by9ffN3vuZeH8Fw2usb+MunTx/fXf37q8f1jLDPV6Tgqz+5VtnpNT0H/p37q4uPZ/A4gnzx8bPv4yo+f/4f2fznz7D591+/f88+vT/d+/jnm5sPb9mHD6fb/19f09QNAFJ9azTM90dtYyjfx8l3Dwv811VQYiWaVeIrLmVGvMpzCz9d/cG52qjD2q7+Dfj59F2vOrcB+P+6+l4L74Jbx4wyV/CtFJS/4zVMduce0R3QAEeA3wPg+9Vvb/7

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d435fdd8-0a8d-4249-86be-1494ae1e71ad.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):44898
                                                                                                                                                                                                Entropy (8bit):6.09589555490867
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWPpi1zNtd450QENzkMEDDLl2KJDSgzMMd6qD47u3+7:+/Ps+wsI7ynn4bEFKtSmd6qE7lFoC
                                                                                                                                                                                                MD5:3665F747F62B4D9482577979E8C4BC85
                                                                                                                                                                                                SHA1:ACB408886BFA26D89E62A83DC66B8EE2B3A5CD21
                                                                                                                                                                                                SHA-256:C00FEA528B7BE4F7F33C9626B414D4A827DD938276492470E7839467320EF262
                                                                                                                                                                                                SHA-512:79B77F291289FF5F8D4435D473C2847B2E5B4B01989B7350DA216E313D1D6034A809EBD16E8D7C662E1CCC89A9338A55CCE87AF30CD6103E1CF513758C187E0F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d58e7bfa-d03b-46eb-8257-3017a6225f14.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):44040
                                                                                                                                                                                                Entropy (8bit):6.094761888550973
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:+DXzgWPsj/qlGJqIY8GB4kWIEi1zNt/TXNQk+KJDSgzMMd6qD47u3+CioVf:+/Ps+wsI7ynZXGKtSmd6qE7lFoV
                                                                                                                                                                                                MD5:2885D00079C25603C6225521AC1FFC7F
                                                                                                                                                                                                SHA1:4BC044B210781FDC1A03B3F43B65882B6F90A3E3
                                                                                                                                                                                                SHA-256:B5AB59B79A3B1849498295159B3A084BD1FBB40486B68DD40266CA8B3C232CE7
                                                                                                                                                                                                SHA-512:2ECED11A447F8B10F3D4EB983D9032A4DF29FCCF708CA14CF341BE46B8A657331A8DA72A221438C1D1B74F1BC3405FEA9304E34CD7860A920FE54C5ABD6D0A6C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2278
                                                                                                                                                                                                Entropy (8bit):3.8509145350959817
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:uiTrlKxrgxAxl9Il8uYTSEsHc0mwP+vQW5DnjY1MCUv/lIkd1rc:mtYeZs8052B5TjYe/Cj
                                                                                                                                                                                                MD5:133BD428122AEEA8C88A3B7B560125BB
                                                                                                                                                                                                SHA1:8F26CEA3F2114FE258E9FD3D3B4AF21BEA619E99
                                                                                                                                                                                                SHA-256:6E83D64059320CC222D3229E64ED441D4C5AA60BB621B2F2EFEEF9055AA913BD
                                                                                                                                                                                                SHA-512:4EC9D09A80DB12385272F4EF2E93334A13E9F76D19E84271C98A1F44C90DA5FF344FDAAD3DABEDEC6F097E307A977DB15BE5E8330FF24B55063948D45C51463E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.5.B.m.W.V.g.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.w.E.L.a.c.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4622
                                                                                                                                                                                                Entropy (8bit):3.9985137780984656
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:CYeZsK70zaAu19SJKq10dZalIkpjy+n//BYvA9:Chgi19S/1G2zdy+n//e4
                                                                                                                                                                                                MD5:80347F3C7905C6BEF7670F870FADC0EF
                                                                                                                                                                                                SHA1:D8EF4874BDA086F69282CA663C8736136A220941
                                                                                                                                                                                                SHA-256:A9524FDE8217E55ECB8BBA54AC2F5266EEB528FBE54B4A6EDF6BC36475094B5B
                                                                                                                                                                                                SHA-512:50B9EDD20310B8D90471A6225A556C04E5AAD01112CB0761BEE8C28258583F0B13B2D0D2B24B28944670B3327EF7F8759C0F53C9370BEA2F74D4C4D39933E6CE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.H.1.5.f.V.1.g.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.w.E.L.a.c.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\plaza[1].exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):3109888
                                                                                                                                                                                                Entropy (8bit):7.973902444546207
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:NTI+C9wYHzDx7P+OEh16n28EERFZk/QX6G+eEA0nfByeNSBxoTRc9EgKb1NRYOuT:NT9qhTsOm6n28EEGa6LrfByeKxoIq/Ro
                                                                                                                                                                                                MD5:880AA312796089DC66459C024727D591
                                                                                                                                                                                                SHA1:9BD32E98F7BE406F236586D56C9A86CC2F6FEF28
                                                                                                                                                                                                SHA-256:EF48B0FEFD01B25E7E76F17F0AEA226DD96E5F0DA3454E1589A0485C116F6D21
                                                                                                                                                                                                SHA-512:E40859947AC49E0CCD8315C26CEC8870855117AC2F39956819DA452F3DB13E0ED2981178F858EA0A6AAA82C2CACFC1697199B613F16DCAF5EE6DC3A46FD6B6BF
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>......8.............@.......................................@... .. .... .. .......... `......,m..x............................`.......................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........y.. ...(..................@....data....."..0...x".................@...................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\fu[1].exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                Entropy (8bit):6.580732602823796
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:7qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgapTK:7qDEvCTbMWu7rQYlBQcBiT6rprG8atK
                                                                                                                                                                                                MD5:791ED44F9B3836A68F79B028EF7C49CB
                                                                                                                                                                                                SHA1:B885B0AC78EC917B259DDCA830DA0DA112A12BE5
                                                                                                                                                                                                SHA-256:0ECEABC886E72C33776BB1F6FE68E97E5C8554852941061CC3AC26A74B5C665A
                                                                                                                                                                                                SHA-512:35F0B529075964F8AACB3C904649EE0314F9038EED3E214211978BD5DD17C05F4C5C8FB967CBC1E4784F06483CC564FDFE3874C24717E75A89D044D482E542C5
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...~..e.........."..........R......w.............@..........................`...........@...@.......@.....................d...|....@..0........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...0....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\well[1].exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                Entropy (8bit):7.035583439961
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:xqDEvCTbMWu7rQYlBQcBiT6rprG8auu2+b+HdiJUC:xTvC/MTQYxsWR7auu2+b+HoJU
                                                                                                                                                                                                MD5:C6ED19F53D1A5C3CEEFD94E6CA7E8E87
                                                                                                                                                                                                SHA1:A4DE47DB43E4ABA2EE066D8938CD54029839757D
                                                                                                                                                                                                SHA-256:960F6B2939FF85AFB2060413635A6338DD08C182F3107574A1823AB9A268179E
                                                                                                                                                                                                SHA-512:4C7CDAF1674B1C44D01BBE384FA8F631C432E719908DDEA7BFBC3CD57D30FFBB65D87C38E2F33ED71023A0C5DCB4C138C2A157ED4303C181591C8A8B921B858F
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......e..........".................w.............@..........................0......]\....@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\niks[1].exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1750528
                                                                                                                                                                                                Entropy (8bit):7.944242713948799
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:ssB0EgavojCNbSNqAb4SboO9A98YzRpcufYJCd78dkBQDuE59sSI8VD2Q21e:sHavoGNGj8ScOSNppYO+QQHfZ12Q21
                                                                                                                                                                                                MD5:1C8A50F3E51F6AE258F38752193B1448
                                                                                                                                                                                                SHA1:8113D74005BB56D0C9A75BB7435FC060596354D7
                                                                                                                                                                                                SHA-256:C37894BBE69843F05952AD09687DD254932647A9E1E0C65E986FCE438E120508
                                                                                                                                                                                                SHA-512:2FD3817B8CFEB1FB41F4F0FD832BC5B2B7C1B1E1A3BFFC13587186176A8AF53EEA99ABB96E2EB6C7C104A80BAAA70B50367209B2FC37A7E6AA2D57D6CA5CD519
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............E.. ...`....@.. ........................E...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...cxfojuyk..... +..z...:..............@...begfdfyp. ....E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ladas[1].exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2313728
                                                                                                                                                                                                Entropy (8bit):7.960248251430647
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:vl9a2WxJEoRrNGmMP7UFFO/ssvEY2/9UPAuz6hlf8KuRwuJGVPt:+GohNGmmyFkssvEYMo+hFJuRpMP
                                                                                                                                                                                                MD5:AAB2D2B3DFC6FB51912C1C12E66E0134
                                                                                                                                                                                                SHA1:FF2567E8DE9D9821F4EAEC8420A35DBCF1859822
                                                                                                                                                                                                SHA-256:66961502C91CEFBF91BCD0349D3A1A43B661BF85A4CAD7D7832F8EBBE4DADAEA
                                                                                                                                                                                                SHA-512:305FA39E9E18743EF05040F3656954F05B74A573B02BE64CCFD5245C3433C7316EF01883E2141FF45563F4751E542B5143B980DE6FA93BCE13F7A1ED0F8646FC
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......0Y...........@..........................`Y.....R.#...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@+.........................@...jyzrikla. ....?.....................@...swzyazqz..... Y......(#.............@....taggant.0...0Y.."...,#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\1071 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):89
                                                                                                                                                                                                Entropy (8bit):4.639517947791548
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:OXmlh/kEPK6aRePubUZmrRDGRgvKiUll/ln:plh/xy6uhrRD5KiUll/ln
                                                                                                                                                                                                MD5:AB17ED604C1D03A94FA41A9B4EDCB0F0
                                                                                                                                                                                                SHA1:73FEA0C82964C1D7B0CFA2FE9459C99E3F4360F1
                                                                                                                                                                                                SHA-256:D3796E1DEF3E16EE613301C7421DC9909CE6DC8CD7EB93B88C4E8C8F75D21DA3
                                                                                                                                                                                                SHA-512:75BD82AF6F1AF5BD92904EA53ABFBBC9405B27ACA6C5AC7CB9AB0C81EC8D17BB0AD0D2C920A32BE2D63CBDA23E8B46A72B032088307EE3B85A7CCC4F5DB70207
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.PZ.........e.Ae.AF./........0....a,~1708035635,:https://spocs.getpocket.com/spocs.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\11701 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):15844
                                                                                                                                                                                                Entropy (8bit):5.969763751075597
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:m7VqN4mApqN3Xo70tNo+pwPm082nyFz/i5Y:TApQHkKo+pwPo22
                                                                                                                                                                                                MD5:C098238115A094C09BF441CDBC1C9061
                                                                                                                                                                                                SHA1:58B286597A95A6A49CEC0FFB04154A1F0CFA4924
                                                                                                                                                                                                SHA-256:2CE02690D45267943A1FE5E629209B0B646BAA178DD7BC49CA4ED2ABA9EFB8FD
                                                                                                                                                                                                SHA-512:7F4F4C25134A54618914B68D8ACEEE0528452F7015BB6A076D95D7C88D609C532FD11C53F668362612865754CD4220C22806FE48922CFD1DB53B7B1E50AEA784
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:................e.mF./.e.m...E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.strongly-framed.0.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA5iMIIOXjCCDUagAwIBAgIRAJKc339ZwIrpCZuMyXFusEowDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjQwMTI5MDgwNDQ3WhcNMjQwNDIyMDgwNDQ2WjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASB6wVGdBTGrYTNLOgcSDG0+J3gPo8rFeHbl1W+ZIBjbbIlAbGtcHWlO5LiWvX/9Ra4EykTj2Z2HH1qM2RuWespo4IMPzCCDDswDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFJDWIvFi4WYw5Ts43/kaYiM+0kSvMB8GA1UdIwQYMBaAFIp0f6+Fze6VzT2c0OJGFPNxNR0nMGoGCCsGAQUFBwEBBF4wXDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AucGtpLmdvb2cvZ3RzMWMzMDEGCCsGAQUFBzAChiVodHRwOi8vcGtpLmdvb2cvcmVwby9jZXJ0cy9ndHMxYzMuZGVyMIIJ7wYDVR0RBIIJ5jCCCeKCDCouZ29vZ2xlLmNvbYIWKi5hcH

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\18734 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):35420
                                                                                                                                                                                                Entropy (8bit):5.086410383118263
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:aPtFYceo3KtwnY9nR+eXHxoZ/HJkNTBdHOT5Qhh7veK8t9KZ9:Aeo3KtwnY9nR+eXHcHJk/dHOTij7539
                                                                                                                                                                                                MD5:CDECDA0521012660C7AE09F3BC165951
                                                                                                                                                                                                SHA1:B8F2B2C0229FAFA37D41E9AB90F6082172B5AE55
                                                                                                                                                                                                SHA-256:5DD6CD2203AEE1E642022E270B611247BC73665D85DEE2358A748C62740B550D
                                                                                                                                                                                                SHA-512:2F2E046353F16D101686ED283DA865DB148A664609AFED5205AAE844817EA061F461EA5132E38630D1E085616ABA6727318440C55FF9E600180DA476BEB5E2B3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Thu, 15 Feb 2024 22:21:13 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\20338 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):433
                                                                                                                                                                                                Entropy (8bit):5.712692708741572
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:ai6/c3Xww+1Ri71R+OR+SR8K7sKdyhZr45Gva1tn:JEw2RyVbIK8hKqa1t
                                                                                                                                                                                                MD5:84C366EA1ECD2BD6BFA5FE8BF64C0008
                                                                                                                                                                                                SHA1:CC1D0C7BCA4B9E73BDEC45B24CFEEFEA10C470D9
                                                                                                                                                                                                SHA-256:CC09CBB8E4A1D4DAC6C5AC5BBFE1C524CEE28FA0D8AF076D98A277474A8F8F52
                                                                                                                                                                                                SHA-512:C2DF1A74ECA120D08C06CC0AACD8BFA00996E026FDB184371916C8F819E42821CEC90CCEE656B8239434C9D0ED3F350EA66842725402528BE3CD6C0C75778780
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..I........e.[e.[F./........u....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjwzyxcB0EB4wZo7BvtnAGjiNDuvz5_J0A9jHm7rUMVPpyf9puZf6eTSmOpLcjt5hb7pHATmFw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1091390242%3A1708035675965753&theme=glif.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\20981 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):126
                                                                                                                                                                                                Entropy (8bit):5.027764674501621
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Vh/BOrV/acll3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:Vh/Bs7Riclp+OGb9LUxG0OKLtn
                                                                                                                                                                                                MD5:20FA252EB4D84F8CD4F32CA40DCF19CF
                                                                                                                                                                                                SHA1:A0D5E60800AAC1BBA2BF4A0385F240445F89C510
                                                                                                                                                                                                SHA-256:ECF01E1EB5AEC09A220F47D3228FBEC78D3EEC4A91A87359F091B902C0365831
                                                                                                                                                                                                SHA-512:18332F2B9FFE909FBB0D6B640850086A974BF2F23E812B0EB7AA23653E9C9F3512396ED75870AF5034C6D2C10241482DF496552957A0A686F326FF012F444F3A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:UD&.........e.de.dF./........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\21628 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):126
                                                                                                                                                                                                Entropy (8bit):5.027764674501621
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Vh/BOrV/acll3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:Vh/Bs7Riclp+OGb9LUxG0OKLtn
                                                                                                                                                                                                MD5:20FA252EB4D84F8CD4F32CA40DCF19CF
                                                                                                                                                                                                SHA1:A0D5E60800AAC1BBA2BF4A0385F240445F89C510
                                                                                                                                                                                                SHA-256:ECF01E1EB5AEC09A220F47D3228FBEC78D3EEC4A91A87359F091B902C0365831
                                                                                                                                                                                                SHA-512:18332F2B9FFE909FBB0D6B640850086A974BF2F23E812B0EB7AA23653E9C9F3512396ED75870AF5034C6D2C10241482DF496552957A0A686F326FF012F444F3A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:UD&.........e.de.dF./........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\23438 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8559
                                                                                                                                                                                                Entropy (8bit):6.093555663397825
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:QruN+nDyVVvpsy4y/GSwTffbaI8j3qWdvdG:QruN5OyrudfTaIdaFG
                                                                                                                                                                                                MD5:F28E4B4545AEC268EECF78AB05A4841C
                                                                                                                                                                                                SHA1:718F257F75628F3E130D2941F5F1B54B3D14CC65
                                                                                                                                                                                                SHA-256:65B15D0A85852A677C70B3FD47AB3C4B34115FB72DBE93F4DD207A47D6189BA2
                                                                                                                                                                                                SHA-512:15E7E9C7B5CCC532ED295ACE4C33896E6FDEE5C6768E3DE63D57D4FBBBAD1CBEB5A4E36336A35F46295817B5C60488D033DAAFFE9F2579EECFC0636630A9E335
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"project_name":"Remote Settings PROD","project_version":"18.0.0","http_api_version":"1.22","project_docs":"https://remote-settings.readthedocs.io","url":"https://firefox.settings.services.mozilla.com/v1/","settings":{"readonly":true,"explicit_permissions":false,"batch_max_requests":25},"capabilities":{"changes":{"description":"Track modifications of records in Kinto and store the collection timestamps into a specific bucket and collection.","url":"http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes","version":"32.0.3","collections":["/buckets/blocklists","/buckets/blocklists-preview","/buckets/main","/buckets/main-preview","/buckets/security-state","/buckets/security-state-preview"]},"attachments":{"description":"Add file attachments to records","url":"https://github.com/Kinto/kinto-attachment/","version":"6.4.0","base_url":"https://firefox-settings-attachments.cdn.mozilla.net/"}}}.-..C#............e.pF./.e.[...2....:https://firefox.settin

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\25752 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):113
                                                                                                                                                                                                Entropy (8bit):4.727018466530835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:xUlh/K/llIpu/XNWbdUyGLk8rLtPSKVIDIIt:x8h/alqp2EbdOx0KVst
                                                                                                                                                                                                MD5:88884F6F2E0DA808F2E81589F20A5074
                                                                                                                                                                                                SHA1:BC943274E7E8591454AD8DF9F1A4703454A1AA4F
                                                                                                                                                                                                SHA-256:D8EA4AAE639DF990224D390919EF44FED7894EF4E4D311BDC755F8F83CF95FAF
                                                                                                                                                                                                SHA-512:714D687A3B20B7C2A9D4549B303DD4F9512706B4F3F40E888E1DEE463FE26965CEDE198DEB75E73469ED5FA3FB9A26E63C147F35FFB21AACAAC0A8AF62ED9581
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..7.........e.o....F./........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\30078 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):15844
                                                                                                                                                                                                Entropy (8bit):5.969763751075597
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:m7VqN4mApqN3Xo70tNo+pwPm082nyFz/i5Y:TApQHkKo+pwPo22
                                                                                                                                                                                                MD5:C098238115A094C09BF441CDBC1C9061
                                                                                                                                                                                                SHA1:58B286597A95A6A49CEC0FFB04154A1F0CFA4924
                                                                                                                                                                                                SHA-256:2CE02690D45267943A1FE5E629209B0B646BAA178DD7BC49CA4ED2ABA9EFB8FD
                                                                                                                                                                                                SHA-512:7F4F4C25134A54618914B68D8ACEEE0528452F7015BB6A076D95D7C88D609C532FD11C53F668362612865754CD4220C22806FE48922CFD1DB53B7B1E50AEA784
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:................e.mF./.e.m...E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.strongly-framed.0.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA5iMIIOXjCCDUagAwIBAgIRAJKc339ZwIrpCZuMyXFusEowDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjQwMTI5MDgwNDQ3WhcNMjQwNDIyMDgwNDQ2WjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASB6wVGdBTGrYTNLOgcSDG0+J3gPo8rFeHbl1W+ZIBjbbIlAbGtcHWlO5LiWvX/9Ra4EykTj2Z2HH1qM2RuWespo4IMPzCCDDswDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFJDWIvFi4WYw5Ts43/kaYiM+0kSvMB8GA1UdIwQYMBaAFIp0f6+Fze6VzT2c0OJGFPNxNR0nMGoGCCsGAQUFBwEBBF4wXDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AucGtpLmdvb2cvZ3RzMWMzMDEGCCsGAQUFBzAChiVodHRwOi8vcGtpLmdvb2cvcmVwby9jZXJ0cy9ndHMxYzMuZGVyMIIJ7wYDVR0RBIIJ5jCCCeKCDCouZ29vZ2xlLmNvbYIWKi5hcH

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\4739 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):133
                                                                                                                                                                                                Entropy (8bit):4.985765007790187
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:+Ul8lh/BOrV/aclEtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:+Ul8H/BsmiclpJWw9LYX24Ztn
                                                                                                                                                                                                MD5:CA30C18092D910F56B01A94D03D10DC5
                                                                                                                                                                                                SHA1:AEF76CEFB8194FAB1E3276F0EBB97F8B096EE400
                                                                                                                                                                                                SHA-256:79A8C3AC89C5A32DCCC51B582D6FE0A9CFC9AD90B067244E9AAFC4AD5B416C4A
                                                                                                                                                                                                SHA-512:79D62E5FDD7781DBB625FB23FC8C6AC9657C47B0F0CCAD0450C491966727A64D66E8B71AE695FCDF679F1223507F42F34F44DB5BFE7B6050388C268C2795BD27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.jT.........e.de.dF./........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\00FA9ECF6E675D2A99AF64E3E7CEC86A323B591C

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):29371
                                                                                                                                                                                                Entropy (8bit):7.449699495003689
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:QBvdHyn6DVVMpVEHVQHM2Ni9aHJnZNCKD7VqN4mApqN3Xo70tNo+pwPm082nyFzJ:wW6vMkHHQ7NBoApQHkKo+pwPo2e
                                                                                                                                                                                                MD5:3A13DBE18C3EE45B7295991CD0AAC4F6
                                                                                                                                                                                                SHA1:3C3D56C45241D2FE3EA7BC6A38092BA2B1BBE4CC
                                                                                                                                                                                                SHA-256:53302DD1145B2B9DD0A45322C20DD24CE072F9779B975BADE5D0F8FE801B33BF
                                                                                                                                                                                                SHA-512:554DB643E50AD69784F2A705484A7B6C41E39632D8582ADF8B4B75849C4AE5366C5754DDCFF0962365594292282FA4FBA7A519F9D0F7016672A41D8848412F71
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:. .$...C."d.........`o.f'....56..KKl..N#....@..&x...j5!@..Adl.RZk...{.{....?....*...HJ].RcH....A......6...4N.u...%u.z.m........D..1..ts..Y.a.Hz..jU>..7TY.!.....-f..q;`V..UCS|..U.y..3M.=.%..+.1..DQ>&Q..8.%.2..:.h..rS...cxf..=".k?.]....4.?.h..v^(&.o[~.!qe......A......d.......!.@.`...'..3.i/...wF....r)......R~...R.e....!....Pj.3.....Ji.K.+.k.._....m...mZ%...|.`.....z....L^K......`o....q.....b.-n..n.d.]..4..{J.|0...@._@...|>2q.._.kG6.\.2.6!9)..=;$#.ae.qK....^.Nq..>g..2...q...O+.,......QE_..(......In....?...`..u.y..v..[._kZ.....e..T1.B@$~..G..0.\.*..m...m."E.{.v.~.e..f....^.4..\~..3W..z...w.mV..,l.o.....^aW......{7...z6..}j..}..-C.....9S.....:...o..u..Cn..?\.j.]../..........p.l....~...o./AKSm..B.-b...}<..<..M_f..QIx...d.c....x]2...+&..a.a.n.....n%..).Qs..qr....R.Q. jL2.i.I.8"!4.w.4EG..}.."0..NJ.8..W..QTq....U...9..:..B...H.......Uk....~.c.X....Af.tT...V.".yC..4..vv.9..S..p.(&O.....)...[6o.w..OG.'...`r.|...o.`...x..jW.*.L... _..W...B.{.e.u!..$.v?.w.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\02E273C14E80C21BD072452EF39BF0327E641ADC

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                Entropy (8bit):6.804627643962951
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:zyAna1ISt7VqN4mApqN3Xo70tNo+pwPm082nyFz/LFd:mAlApQHkKo+pwPo2I
                                                                                                                                                                                                MD5:B65723C4E80891C5483D86AB7710A106
                                                                                                                                                                                                SHA1:5C32D15E608B2431783E1B13652D8B0597EFC0D6
                                                                                                                                                                                                SHA-256:B0D734EE62C43BEEC989C57EB9602507B9E2FBC1F6F9B98D468DC14E3CE0E069
                                                                                                                                                                                                SHA-512:7370CB047DA3AA19CE9CC8B6106BE82C1DB31DEAC80B100A7CAC4D9FEB0242D4AB5628CC6D6F7A706316B8EA1EEF6DBA675B7DA4869C54276FC4583BC05593E0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.`Z!...."d..._j....jG...`7.R_....=.....s.'..~S.E._J...{....d.....>...-A.!._.j..Q.H}...&+......=.V.1.-[l..t.tl...!....s..........9>.O.M.X.....B..b..HtG.HKs..R3=r..h..\(uf.8_e.......0......l.....m....".:W~J...9.......@5..8...h..J..>W+...../c.K.J7..2p5d.w(..(K.m).B...oe.....h.I..r.Hl.D...VD....c.R....MU.ZB......#.._..\..-z=..H...:.#u...ar.y@53..&.`z.g...k..c..J.....l.k.f_..*....z.'.%.:d.......`.2_5..g....\.0.3e"..|3...B.j..G[6..982J.7.<*._3+[....Ck..suJ...m....._.3;...ab.;..,.......T.4.i..~.X....K}L.e.......8..[......8v.(.Q.4L..83V..4....X....k......M...Ui.*...d.v..j.~.n_?}.Z.....?.....%X..;..Q..j....W.IZ.:.t..*c.[.(z..Or.~.R..F..wM#.....y..vU....4.N......k."n!Q..1B.....0f&.y.0...OHU,...&..\...&h..2f.......l.. K....>........g..p........v.q..;.2.5.24..a.b..V7..[..{1.$.@.....V....}.j.c+.wh.R.x.h..OU..OaL.S....8@zp&A.\..7...\E...)c..e..;....'....R;.+..:.jQ...m...t2.0D{........s.r{.b0.B.e..Ri?.cG...1.......o....TN..'?."Kr^d..iEd..c.....l9u...#L@....,F.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\02F6463DFBFAC08B94C9FDAACB7AA66D176E53B7

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):21815
                                                                                                                                                                                                Entropy (8bit):5.766593512401482
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:DGhqb4AexlNlP3me3m+5OyrudfTaIda+r:DGhqbNeVlP2e2+5OyruJa8/
                                                                                                                                                                                                MD5:EAC7062592BE3F4FDADE2EFA6090B30F
                                                                                                                                                                                                SHA1:87970960F1AC31BAFAA149C2FFAF3F96066255B0
                                                                                                                                                                                                SHA-256:271E9A77F0E18635B60934C5314BD9DBC19C11E5590BCE76A20E083858308899
                                                                                                                                                                                                SHA-512:88D63F950B8FBF3C17F192C654AC9CE458BB3AF4705AEEE2B648F92E0FF378FB1B2AAD9D51F8814EDE02D488AD132C7CDA50D2E507DEC64D21AE865A020EB45B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"-last_modified","schema":{"type":"object","required":["webExtension"],"properties":{"params":{"$ref":"#/definitions/params"},"default":{"$ref":"#/definitions/default"},"appliesTo":{"type":"array","items":{"$ref":"#/definitions/appliesToSection"},"title":"Applies To","description":"This section defines the region/locales/application information for where a search user is available, and any specifics for that region/locale/application. If there are no entries in the list, it is considered to be included everywhere"},"orderHint":{"$ref":"#/definitions/orderHint"},"extraParams":{"$ref":"#/definitions/extraParams"},"telemetryId":{"type":"string","title":"Telemetry Id","description":"The telemetry Id as used for some of SEARCH_COUNTS telemetry."},"regionParams":{"$ref":"#/definitions/regionParams"},"webExtension":{"$ref":"#/definitions/webExtension"},"defaultPrivate":{"$ref":"#/definitions/defaultPrivate"},"sendAttributionRequest":{"$ref":"#/definitions/sendAttribution

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\0EA2E1AC3653A248EDE38E975FF2A4ADDA308244

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):492270
                                                                                                                                                                                                Entropy (8bit):7.997759723240645
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQa:fZrUPE5I1g9M6yyZ0AgYra4t
                                                                                                                                                                                                MD5:11911A1541F0C19C30E22E25182E8921
                                                                                                                                                                                                SHA1:A7E5FAF7268000A8ACB0D3B538BCB549B122AECD
                                                                                                                                                                                                SHA-256:87FA8AACF53CE6C8C5BCCD981CBAF42AE17A17C1590E04029D744DA3AC0C42F3
                                                                                                                                                                                                SHA-512:C03D801A4A72AE752891EA269547799BD494B22668FCF0E07F0D8CE2A12DC980DB391E5E5C25C7F0E003FE3AEC2F46F91322A2F138C14C035484D460FE5543F3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:PK...........V...,.}..........gmpopenh264.dll..|.U.8.I.....`....&l.Vpm.5Sf.N.(.."..YXY.%....V:;.......>....u.-...U....(.E.?*.ES.R..?...{'i...]}.}>._?Mr.....s.3s'....Ng.O0..m..?...z..4~{...w...H.\3{....U?*Y..K..+W.-K......,_i.g.k....NJLL.j0F..y..[?}1..........'.G^.#..^.C..{1.~..>.i..=............>}i.......h..h..t..O..^>w..PY.n.e.>...%Q.3....&H.d9....tqZ..pg3....G@u!.........[.4h....E.w.Y...~_1.^.#!f.+,.au......,._..:&...{N..1..~p..~?..DJ..T.".,.vR....u..P........8D;.,.BOp..........D..'...q*..l...;..6$.........9&.<.bU....dExynP..KK.........7~M.X....?.-Q..*.....zs......>..\...bv...y...s..+zN.Kr.(. .Ee.QRco.8..8.~..o..D.OT.5......O.gC.F.3..E......('..>......2Eu.5]l.t}.`...:j.....IW.u...J.....H.m.R.Tz.....O...*..Q...9..j.c.Uc...U8gD..q.^.3..|..Q.g[..Q6Q.q.....GBg..F[.\...D.C.?:1.}.../.t ..`.....}..........@...8c.G.....o. .......TyK.....sS.S..a.a..LR.0.k,.</;"...L.!WDp.M....8r..S..kq..o.0.m.-..,Z.[...>.G....P~.|.7TR...Ug.7.j......8Q>-.u..

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2407BBD349B5AEAA54E123C61133FC300D2A1C81

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1048576
                                                                                                                                                                                                Entropy (8bit):7.999600972984212
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:24576:x8FVxeHiuCvXyDsrUievlXwtTrNc+3cp0tY372GzpExzb3jD:x8FVx4iJvXyDHvlXwt3i+Mp0Kr2zD
                                                                                                                                                                                                MD5:11EA72EC0BAA03E5D8B6595B39C25306
                                                                                                                                                                                                SHA1:A031BB15D80D548398A0D5EB1863B78EC4649201
                                                                                                                                                                                                SHA-256:C37FE6B0D8C7BDCC81707C3C38AEDFBFEC8807B007E673450EA27B849BFB67EF
                                                                                                                                                                                                SHA-512:3791ECAD2958A80BB40DF0D3EC42A0BD5D3095908F24A00552ADA86C08751F10E4A9D28471A4FFEBB02A35FBA3E40C7722A7820E76FC85167C7EDBD8A48DC0BE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...?)....y...V.vPp.{lfP...`.....y....Y....p....A1...D.D.LP....q.....@UUUU}..c..&;....-....-(..".-(..".-(..".-(..".-(..".-(..".-(..".-(..".-(....WaU..0.i.+.Q.'JC.c.5..r..u.'....N!....(.........Y<[.:.....+.y.@....k...C....PC......+.%.P....j...#..e.\#.....+.U.H...Wk.G.c..5.Vc......+...X...7j......M.Y......+.m.D....k.'.S....SS......+.=.T....j...3..}._3z....+.C.L....k.g.s..#|Tsz.....+...\...Oj....Z.S|Z.z....+.s.B....k...KZ..|QKz.....+.+.R....j...+Z.k|]+z....+.[.J...ok.W.kZ.;|Wkz.....+...Z....j......G.X......+.g.F....k.7.[....R[......+.7.V....j...;..w.^;.....+.O.N...?k.w.{../.U{......+...^....j....:._.[.......+...A............p......@.6.A.fpC..P.6.a.gx#..HF6.Q.ftc..X.6.q.g|...D&6.IMfrS..T.6.iMgz3..Lf6.Y.fvs..\.6.y.g~.X.B...E-fqKX.R...e-gy+X.JV..U.fukX.Z..u.g}...F6..Mmfs[..V...mmg{;..Nv..].fw{..^...}.g..8.A.v.C..pG8.Q.v.c..x'8.INv.S..tg8.Y.v.s..|...E.v.K].rW..U.v.k].z7..Mnv.[..vw..].v.{..~.x.C...G=.qOx.S...g=.y/x.K^..W..uox.[...w..}...G>..O}.s_..W...o}.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8402
                                                                                                                                                                                                Entropy (8bit):6.09564164952494
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:vF+nDyVVvTsy4y/GSwTffbaI8j3qOcdB//dByr:vF5wyrudfTaIdLB/VByr
                                                                                                                                                                                                MD5:2A4C955E046BD94108AD78EC2B44A4B7
                                                                                                                                                                                                SHA1:838898D25C240020835DFE5E467F2222BFDBC78E
                                                                                                                                                                                                SHA-256:84EAF695C7A248C0DCD571C4B4179D37469CA1D38CF85CAE99AA2105A9728E20
                                                                                                                                                                                                SHA-512:F08AE74BC16F0B086A67305DD4AA49FB7E4FE3FA1910E811C8528A263D90FBB5B257E82297402854011E541A6957867CE3F6792D7EEE4C3F4DB99360B091A5BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"attachment":{"hash":"0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0","size":7581,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl","mimetype":"application/octet-stream"},"id":"cfr-v1-en-US","last_modified":1648230346554}}<..u..........e.Ze.ZF...e.u...q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAXxMIIF7TCCA9WgAwIBAgISA9GY462VxzkuNQVlgf6OzP59MA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwMjE0MjIyMTEzWhcNMjUwMjEzMjIyMTEzWjAmMSQwIgYDVQQDExtyZW1vdGUtc2V0dGl

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2C38417510E54E5D1E5F1064AE739BB0E1232C2C

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8054
                                                                                                                                                                                                Entropy (8bit):6.042769945552959
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:/HMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEc1LUcnLUcK:LDyuV2Gv+FwEIqSRKcmvwNbZovEX
                                                                                                                                                                                                MD5:F885E15624B9C3AFDD389EC9FA178592
                                                                                                                                                                                                SHA1:65FDCD25D59FD1A99E3C61BAA34767F0EBB2DDAB
                                                                                                                                                                                                SHA-256:2008F70750206CF9EC8A4AD93926E8AECC8EDBB6B640D71A8599DC6559F6A4D4
                                                                                                                                                                                                SHA-512:E72EC268E45AA2C6DC293211829EF24552CF731B29D3A93932F6F7263F04CA059B141D639C61343CB24A4E20BF084B59B835A965548BEE57BEA1D51D6161391A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............e.pe.pF./.e.p........a,~1708035651,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/4db4139f-6dcf-40ae-89c1-1ca4ca5a35ed.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2CB84DD9ABB4E1485D83397C59B193094E1ABFC7

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8637
                                                                                                                                                                                                Entropy (8bit):6.105333246584716
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:eB9+nDyVVvpsy4y/GSwTffbaI8j3qWdpdI:K5OyrudfTaIdazI
                                                                                                                                                                                                MD5:DAF4A016CA986CB45D458F747761160B
                                                                                                                                                                                                SHA1:DF645E24032D86A9EA04F5197D0BCE26A00BDD32
                                                                                                                                                                                                SHA-256:CEF3B946ED5FFB4C2BDBEF76B0B6264F8966DEB41BCD19C3B34A92146C917251
                                                                                                                                                                                                SHA-512:8D813609FCE5AFDDD4EA09789F8470B30FBAEBF6D680CC110A16A4CA3DB43F5C93AD6CA4A09D1872DA12E09E6936A6FF3C96F536563AC9F4C65E3416C3E1BCC5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"signature":{"ref":"1b9nz0j6iu5hw1hafi83tsancn","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"_v0mlw7uAYJ3bHdXxck6OH4JH2snkvmvGg33Tuc4fxSTS8mDqhmDo1jwzJHHY75DKjNHMNpawQ6LfTbAcvJG2-njx4UfoHUwnv9NmQzUl1G1IAl8brEzGOZrCdixr2KG","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"displayFields":["token"],"id":"anti-tracking-url-decoration","last_modified":1707350424396}}.M.P..........e..e..F.0.e.N........:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/anti-tracking-url-decoration?_expected=1564511755134.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\2DF093FCB3888C9A84AE5986E145884D3AE4F463

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):15961
                                                                                                                                                                                                Entropy (8bit):6.06854998791553
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:V7VqN4mApqN3Xo70tNo+pwPm082nyFz/LQG:eApQHkKo+pwPo2q
                                                                                                                                                                                                MD5:03DB6279D93358CCA7A11A035F0D3AEB
                                                                                                                                                                                                SHA1:048AEF0D86F1EA31CF12E5C064A232FCE9CD115C
                                                                                                                                                                                                SHA-256:D208763CDF64DF14B28A394B3657316A508A6694AA3BD3329F5E62332111E8DE
                                                                                                                                                                                                SHA-512:183BF90B303C86AA2473BF28A18E6B2951B74CFE18CEDF64EF5F89B0948F676FB7AE6EF69B30F633CCBEED7BF8249BEFA9702F3C7143EEE17EE8D10B1BC9E8FC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... ..R%.\.%sv.....}...ht~..s..P..6].A...ro....-FY..-..N....(".....T.."..Y...m.b. = ...UU...:5.-.i>..gj....$.g#..]...........:K5a./f. .U.H..t....:..7.D...F....fAl'.}..e......q.8.9..X..r......;. .....F.*.A......n.Y......}..$0z....N.v.D.....N...'!.Wr.........e..e..F.0.g......k....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/s/desktop/bdb59273/cssbin/www-onepick.css.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA5iMIIOXjCCDUagAwIBAgIRAJKc339ZwIrpCZuMyXFusEowDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjQwMTI5MDgwNDQ3WhcNMjQwNDIyMDgwNDQ2WjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASB6wVGdBTGrYTNLOgcSDG0+J3gPo8rFeHbl1W+ZIBjbbIlAbGtcHWlO5LiWvX/9Ra4EykTj2Z2HH1qM2RuWespo4IMPzCCDDswDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQ

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\30F34EAA36BFA2091C6F178ED9BFE29C547FB4F6

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9028
                                                                                                                                                                                                Entropy (8bit):6.114364920420177
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:OB2+nDyVVvpsy4y/GSwTffbaI8j3qWdHcdHf:55OyrudfTaIdaM/
                                                                                                                                                                                                MD5:62E64DEC3B4A87DBDA010EEF20D3E2BC
                                                                                                                                                                                                SHA1:CBA7F850FF0BCEFA49F25F10D9848FF42E38EACF
                                                                                                                                                                                                SHA-256:A2C83B74ACD3A0F12763B911F1AB59AED9F398D5C41C83A6A646AFC79F26A7BA
                                                                                                                                                                                                SHA-512:42A98F8F3F66B8605E4F7547C74646F74BB4D59E1238E3E277221C5577FFABAEAA0A88FAE7530D0373D081CD3BFA5ADF8D2206E827857C45AE45F4696E47FFB9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"sort":"id","schema":{"type":"object","title":"Language dictionaries","required":["id","dictionaries"],"properties":{"id":{"type":"string","title":"Language","description":"Identifier (eg. \"es-AR\")."},"dictionaries":{"type":"array","items":{"type":"string","minLength":1},"title":"Dictionaries","minItems":1,"description":"List of dictionaries identifiers (eg. \"es-AR@dictionaries.addons.mozilla.org\").","uniqueItems":true}}},"signature":{"ref":"hul6otin4ywa1b50khr0ent8e","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"5IdtPXIm2zxORdwFzXbJ0-4lkTZANtiAnnY0jRy3wlaCnyHlh4xmDPg5xbmlulr5MKLTB6QvccHVuB8ZIMojOVLrBbfFYpnm-C8p-eZfr9O-76NYPRrDU9potzQ9Ivgb","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aD

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\36E02E1B33269032456E45CE237E27B659E1E282

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8695
                                                                                                                                                                                                Entropy (8bit):6.113460605069463
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:WBbb+nDyVVvpsy4y/GSwTffbaI8j3qWdYldYc:ob5OyrudfTaIdaSD
                                                                                                                                                                                                MD5:4A33733B3AE7CEE0FD9989165D8D8F01
                                                                                                                                                                                                SHA1:617CD300BDD330650B59D1FB430D41E49AC3C315
                                                                                                                                                                                                SHA-256:FFF54F1FFDF3AA55791EBF54923C076B7ED7BCD7B81C31B5DCEA4561A334BBCC
                                                                                                                                                                                                SHA-512:61BCA93CEDBC8D5DA163DCEC23E79D059BED17488CDCE11057028B73B27AF50095A87A8B2F9BB56E1BDEE69B40B7939E37982989197BFDDC1002A43C8F2F05F4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"signature":{"ref":"uwp4cih0f7kb2ytulcja2zrxt","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"l52ZaP4ori2AcuZHfkRYznJRvRnLqR5xxJvHCCd3SFGS0j4cjeuuQ0zkc33NfvsgO95hxTWuOOVd9n20Sfj_KKek9O5Ub09D6KnUQJGRp7Bl2zuh8f6hJtWH7SZeXFGB","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"id":"message-groups","last_modified":1707609606218},"timestamp":1697058525985,"changes":[{"type":"remote-settings","enabled":true,"frequency":{"custom":[{"cap":1,"period":15778476000}]},"userPreferences":["messaging-system.askForFeedback"],"id":"micro-surveys","last_modified":1697058525985}]}.E.q5.........e.ze.{F.0.e..........:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/mess

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\39D80535A21E286B3C662765C5F09ACEB927E77D

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8594
                                                                                                                                                                                                Entropy (8bit):6.101622681367484
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:oEB5+nDyVVvpsy4y/GSwTffbaI8j3qWdfd/:p5OyrudfTaIda1/
                                                                                                                                                                                                MD5:6C62721BCD21DB76D5A11C3CD1A2499C
                                                                                                                                                                                                SHA1:59391BDCC2C0A907D30C3DC34EB577BBD225132F
                                                                                                                                                                                                SHA-256:C90D4075F75DF115EB5F254065154A8EA5FB353B6599262E935EC0FF4FB32607
                                                                                                                                                                                                SHA-512:08396A74CAC9F7FBE678C217C3DE3B8BE1153E2E1FEAB7F867C16907B62F6FD24BB61DB50A7FC546F570C57BA5300F5677FE2E61E5733851E65658609E0341CF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"signature":{"ref":"mb5nz6htmh701w4aggidqxwj7","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"I-eKOAs2_8j4tkUyn3rf7Ot30gUoEU6U0VGk3zkvAz8LQhPkZrToPfvoaZw9lsK7M3CPICNRslkzs526Fc27qb8MXb2l5m6ysVaXb85Rd3Z7y8imiKTtPL2QcyaIkoEA","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"id":"sites-classification","last_modified":1707350425142}}>E+...........e..e..F.0.e.1...w....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/sites-classification?_expected=1544035467383.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAXxM

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3AD2553033F2FDF3452381EC30CB5BE655BDD9BA

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):19599
                                                                                                                                                                                                Entropy (8bit):5.894162840381299
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:qQbwapzfz86fBPSgVzZFQa5OyrudfTaIdaLe:qQbwapzfzBfBPSg5nQa5OyruJa89
                                                                                                                                                                                                MD5:C333602C3957876854FDAE3EE862646B
                                                                                                                                                                                                SHA1:18205EDB29FB75C236900140FDD0F1D910D95CD6
                                                                                                                                                                                                SHA-256:7E2415A8DE958B2E1D8C6CB73F4D6071EF6A4044A10FF476E78CC274FA9E7531
                                                                                                                                                                                                SHA-512:0CDBA5D72D9C5DE2F55EAF009844995670F9A9312B484A541770B6CB32E192E2C2E22E3FBA2484E0115E5F6C0127199E20F188D0325EFE8FD54ED168F4E032F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"-last_modified","schema":{"type":"object","required":["telemetryId","searchPageRegexp","queryParamName"],"properties":{"taggedCodes":{"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9-._]*$"},"title":"Partner Codes","description":"An array of partner codes to match against the parameters in the url. Matching these codes will report the SERP as tagged."},"telemetryId":{"type":"string","title":"Telemetry Id","pattern":"^[a-z0-9-._]*$","description":"The telemetry identifier for the provider."},"organicCodes":{"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9-._]*$"},"title":"Organic Codes","description":"An array of partner codes to match against the parameters in the url. Matching these codes will report the SERP as organic."},"codeParamName":{"type":"string","title":"Partner Code Parameter Name","description":"The name of the query parameter for the partner code."},"queryParamName":{"type":"string","title":"Search Query Parameter Name","d

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\3DE122AF51E9C396743DA36D6F24FC9288BA6D86

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):10991
                                                                                                                                                                                                Entropy (8bit):6.087294723485082
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:38YPmO+FaPYeoBPw+nDyVVvpsy4y/GSwTffbaI8j3qWdZdg:MYAk5OyrudfTaIdajg
                                                                                                                                                                                                MD5:E34E717466345F3B09BD959CC5F6E774
                                                                                                                                                                                                SHA1:B4C6980031069407E12F4C682C69682061750019
                                                                                                                                                                                                SHA-256:077DDA0584C9936F2C5569ECDF14ACE5B506CEACE04A77923DB32D5F9F3D1A61
                                                                                                                                                                                                SHA-512:31567DC48426E580EB6393493758D96386FDF23F26A4077D08162F1FB0E53557CB32A624D8B87673C37F6408EDA6A916D210ED6054E133C9FD5D69F735029813
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"-last_modified","schema":{"type":"object","title":"The root schema","$schema":"http://json-schema.org/draft-07/schema","default":{},"examples":[{"id":"cloudflare-US","uri":"https://mozilla.cloudflare-dns.com/dns-query","UIName":"Cloudflare","autoDefault":true,"canonicalName":""}],"required":["id","uri"],"properties":{"id":{"$id":"#/properties/id","type":"string","title":"Provider ID","default":"","examples":["cloudflare-US"],"description":"A unique identifier for the provider, for referencing in regional config"},"uri":{"$id":"#/properties/url","type":"string","title":"Provider endpoint URI","default":"","examples":["https://mozilla.cloudflare-dns.com/dns-query"],"description":"Used directly as the provider's DoH endpoint URI"},"UIName":{"$id":"#/properties/UIName","type":"string","title":"UI Name","default":"","examples":["Cloudflare"],"description":"Provider name to display in UI. Provider will not be shown in UI if omitted"},"autoDefault":{"$id":"#/properties/au

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\421C47CDDDB5FD6A5B2306A559DEAB4FFF5A1DE5

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16563
                                                                                                                                                                                                Entropy (8bit):6.238664480890649
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:m9CwLTL+7VqN4mApqN3Xo70tNo+pwPm082nyFz/LdP:m9NHHApQHkKo+pwPo2O
                                                                                                                                                                                                MD5:FC28E18B12F5AC26FD3CCBF9F259B109
                                                                                                                                                                                                SHA1:85920950B79CF9F27D83C5F5D7449933B0D11A51
                                                                                                                                                                                                SHA-256:1278D65594691B44FD51D8388C264D044091C23652E55383EB8C50511FF142CF
                                                                                                                                                                                                SHA-512:CE4EA1D19B96D1207CAA503F227A6598240DF61C3AA992095A24FE0C9D6D203EE167C3828C53657D6E4169A9AEA8A67E8CA39053D94C573B8AC235E4364B791F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..@. ......L1p![l..w.Q....M....u.0....[....,.......wq;i.a.~_[.`...`!..3z..U...;.8..pWY.r.so=...=.j.&...+.@\#.....?...,.`,.*.....q.......'.U]..U...?(...........}IO.ImA=.I..@.>-.....;...5en........9.../.5I...9.g8t..,`..=G`.L.D7..........3._9....@2&]m.._...R.c\o.3 .{.N..GC..*......E.GQ.....k.%...>.9..k.....Q..C./.. .P+..uK....E..p.....a.).&.....gD .....".D.Y....;_`...{.3@.M...K.T.,T....D.Q..O.Q..O>..?..b1.n..pfy...)..S;Ca@.M...6j.D....B2..P.60>.;....,].W\..Q........A.......L.3~.*..a.{.Y......7eH.E...~I>...Ps.\..Q.2...)...mn..\&.8..b...:{.3.e^....Si......3...`..,.]......X.5...O{...%_`...@.@....(.:U..@e.)`.T1U........\....l].o.@_+..QGhN.(F..c.Er.M..P.L2...p..|.....(2V..D...?...GJ...&..s..z(.o.....D...v#)S.......H..ZSJ......O....CU.......1.6...QM........e..e..F.0.g.,.........O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/s/desktop/bdb59273/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js.necko:classified

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\463486665093FCEECBC388E5A3D0B71138B36702

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):10346
                                                                                                                                                                                                Entropy (8bit):6.08316958334348
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:KM/TKAo5mB6+nDyVVvpsy4y/GSwTffbaI8j3qWd8dk:KM/T0H5OyrudfTaIdaMk
                                                                                                                                                                                                MD5:C6CD512A5E37AF1825F39063D4397FEA
                                                                                                                                                                                                SHA1:9439EEF3CA45B10EEC7026096728FB8333A477E5
                                                                                                                                                                                                SHA-256:C4D54CB44DBDC3556A3B127FFCF8751E7F01B9B47BA83D2550E9B9432A64984B
                                                                                                                                                                                                SHA-512:CDAB48A9948C1FD329ED557FA1BD9B072E882265CD657455F0D3ABAD5CE1D09A07E476699C5C913CF137742936E142C8CAB875D19C20652C2587910CE2C3E290
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string","default":"AddonManagerSettings","description":"The default id should NOT be changed, unless there is a specific need to create separate collection entries which target or exclude specific Firefox versions."},"filter_expression":{"type":"string","optional":true,"description":"This is NOT directly used by AMRemoteSettings, but has special functionality in Remote Settings.\nSee https://remote-settings.readthedocs.io/en/latest/target-filters.html#how"},"installTriggerDeprecation":{"$ref":"#/definitions/installTriggerDeprecation","optional":true}},"definitions":{"installTriggerDeprecation":{"type":"object","properties":{"extensions.InstallTrigger.enabled":{"type":"boolean","default":false,"description":"Show/Hide the InstallTrigger global completely (both the global and its methods will not be accessible anymore). IMPORTANT: The webcompat team should be consulted before turning this to false, becau

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\479F651B48A6DC853B91AD6F134A645BFEA2FA39

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8054
                                                                                                                                                                                                Entropy (8bit):6.041309733642493
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:8VMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEc1LUcnLUcK:CDyuV2Gv+FwEIqSRKcmvwNbZovEX
                                                                                                                                                                                                MD5:A6443804799DFB2472701FF7C7C57109
                                                                                                                                                                                                SHA1:CDD4E1D5C9473E17E78D045138E6DC8C9CA10C48
                                                                                                                                                                                                SHA-256:D04E1ED14826A30A2E07291E1E802CA8F95587351B28109FFE05DA208C1F86AF
                                                                                                                                                                                                SHA-512:517305C2FF594B4915C82469F5FFA5AF57553AB40CFDD3A90313FCDF8F787B8EF96868FC9E3298E6A206AC4E6933C9E812C91E5F9CB610BDF8C071D16D105701
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:r.q.........e.pe.qF./.e.q........a,~1708035652,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/b38522d7-1787-4855-a312-c27916e30610.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:PEM certificate
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12989
                                                                                                                                                                                                Entropy (8bit):6.042515629772575
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:Hhyu9fiGLm4pUzcjQ/fTpcjQ/fTgtL2Mhsh9:FBi8mCUzcjurpcjurgcd
                                                                                                                                                                                                MD5:3A4E9DB54ED849A2FB931B54EB5FAAE2
                                                                                                                                                                                                SHA1:0A3D979A058BD7F49BA496757501E45D9DBA3F54
                                                                                                                                                                                                SHA-256:F5FDE1FE6803F8FB929F073B2EA6966402A186FF2D113002D35D682D22A26F50
                                                                                                                                                                                                SHA-512:7FE70BA234403570D3DE967245A039D04715A92D0FB81925281E367D0692B939557BD82430BFB6E1F4B9D4B5C682F526332B57BF5E7AA6838B02F115E33EBE32
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:-----BEGIN CERTIFICATE-----.MIIDBjCCAougAwIBAgIIF68YC/b1N40wCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIzMTIzMTEwMDcwM1oXDTI0MDMyMDEwMDcwM1owgakxCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczE2MDQGA1UEAxMtcmVtb3RlLXNldHRpbmdzLmNvbnRlbnQt.c2lnbmF0dXJlLm1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8s.qFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBc.rrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+to4GD.MIGAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME.GDAWgBSgHUoXT4zCKzVF8WPx2nBwp8744TA4BgNVHREEMTAvgi1yZW1vdGUtc2V0.dGluZ3MuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwCgYIKoZIzj0EAwMD.aQAwZgIxALPmOSBrIfgQlrVZ6pop/EoOUGMMZTxt0NdQqcdr5IPi+vDJ6c5sWS

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\485E25694D3F5413F6877442413C4EB3743C8F8E

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8054
                                                                                                                                                                                                Entropy (8bit):6.040016147347697
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:TiMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEcgLUcCLUcK:YDyuV2Gv+FwEIqSRKcmvwNbZovEL
                                                                                                                                                                                                MD5:FD56E3357E7E5344770A987BF2253A6F
                                                                                                                                                                                                SHA1:A737E27C09FD78F9FAE1B720E36EF7C8206F6E08
                                                                                                                                                                                                SHA-256:23E6EF605D51037FAB7E143FBCD3C347E49298C21E241E22CFE03DBC8D496B1E
                                                                                                                                                                                                SHA-512:4836F7B8848DEC3000654739F2A60F01F6306DEEC09958DC396AB5A73F95E973306230BC2B036BF2E1B1343802F326056D759246E6ACE6301AC71B5497E58669
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:N.-.........e.te.tF.0.e.t........a,~1708035658,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/a1eef2b7-1be1-45c9-93ee-1bdd03805783.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4A310EEF15BA8905EFB4A4C053A96628E368E3B3

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9349
                                                                                                                                                                                                Entropy (8bit):6.107708954900992
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:Y1rBS+nDyVVvpsy4y/GSwTffbaI8j3qWdB7qdB7M:yU5OyrudfTaIda4+
                                                                                                                                                                                                MD5:CD0DA1993220A8D119BED70C46FC9B57
                                                                                                                                                                                                SHA1:CCEB7462DBD6BAD04859F61649FF2BF203C2CD95
                                                                                                                                                                                                SHA-256:996CAB1D277C9A38EE46C7667F12FC740F5B2DFD07B9FDC4F38C0B1F1DE0CBF0
                                                                                                                                                                                                SHA-512:6F7A19C53D73FA8C13CDCA74718ABE7420C4BE2E95B6314DDC90260F23AE7BB1F136E8C23A596CF669B079186EF2EAB0697B2CE1497CF8ABACEA46667997166C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"schema":{"type":"object","required":["description","hosts"],"properties":{"hosts":{"type":"array","items":{"type":"string"},"description":"List of hosts where this recipe applies."},"pathRegex":{"type":"string","description":"Match certain paths."},"description":{"type":"string","description":"Site description."},"passwordSelector":{"type":"string","description":"CSS selector of the password field."},"usernameSelector":{"type":"string","description":"CSS selector of the username field."},"notPasswordSelector":{"type":"string","description":"CSS selector to exclude fields as password."},"notUsernameSelector":{"type":"string","description":"CSS selector to exclude fields as username."}},"description":"Password recipes"},"signature":{"ref":"16dtoebb8qx6xnvbmgw43s0e1","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"4rY0Xl

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4B98896D46EF154C9F2E1018C0BFC4C9F0ED21EF

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):433
                                                                                                                                                                                                Entropy (8bit):5.712692708741572
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:ai6/c3Xww+1Ri71R+OR+SR8K7sKdyhZr45Gva1tn:JEw2RyVbIK8hKqa1t
                                                                                                                                                                                                MD5:84C366EA1ECD2BD6BFA5FE8BF64C0008
                                                                                                                                                                                                SHA1:CC1D0C7BCA4B9E73BDEC45B24CFEEFEA10C470D9
                                                                                                                                                                                                SHA-256:CC09CBB8E4A1D4DAC6C5AC5BBFE1C524CEE28FA0D8AF076D98A277474A8F8F52
                                                                                                                                                                                                SHA-512:C2DF1A74ECA120D08C06CC0AACD8BFA00996E026FDB184371916C8F819E42821CEC90CCEE656B8239434C9D0ED3F350EA66842725402528BE3CD6C0C75778780
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..I........e.[e.[F./........u....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjwzyxcB0EB4wZo7BvtnAGjiNDuvz5_J0A9jHm7rUMVPpyf9puZf6eTSmOpLcjt5hb7pHATmFw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1091390242%3A1708035675965753&theme=glif.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4C817A341D7BB4DEC0F845BE92B472A933AA6D63

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):30982
                                                                                                                                                                                                Entropy (8bit):7.487021153593745
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:RfIprxJuDyB/oeyQFd2SYxQUnoSV9dyzkRx+ol7VqN4mApqN3Xo70tNo+pwPm08h:RfIpPBf3Ohnoi3yI+VApQHkKo+pwPo2m
                                                                                                                                                                                                MD5:63DF5FCBBF4EDED266D7A4223153F5DF
                                                                                                                                                                                                SHA1:7F11E5FF175FC6534F54DE99F93F8682C3AD8B11
                                                                                                                                                                                                SHA-256:8E5A966EE43EAA5F119AE3ABD8C4A6673203872FC75742B531841A682F4226B0
                                                                                                                                                                                                SHA-512:276A0D51F410E19FC1637357B99E514305BDA7E4ABDADA08605DE21B4FCCD356F71203E7DAC4A8E857D2EE84504E3B1810ACCFDCDBDE3AD3C82CDEE0DDB05E71
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.h0......"0n.c...............!9.....Cz..i_...,...........e]6.rI9.)2>R)..d3).....R.W..4...... .........~3...`O0.+.<..9r...@.k.X9O.E.*..2..pU..VDB...C.JO..O......=....no..S....!..3...3.........Z{........a......._M.W.|....b....a.v.!M..Se.c..P.-09.0.].@.Y>.a.0O...K7uW..7.W...)1.....*.N....q..(...c...."..*..L1...u....Xl>Jm..~..as..|..v=.0.i-...1.....T...l:..OJ.)F...B.J..).=.y3.4a{....D.M.M.z6....^=?<.a....._/.WOO....g.....}xy...l..d...k~}x.....d. A.L.+..f.e..n.9..(un....M.%v...=g.n{.....L.Z^..^..._x........:.;..l.;.....r..[U.....iz.{[VV..+.E$u..TG....6Y....).....V.dUO<.A}7..CUk]-....%.R.H.R+..D.XYB=sU.'.}....S.....A{..9......{....p..,.k.......(w...,C.5Gm........c..,h.G8+.7X.VGs..MW.......V.X.r...8q8]b..)."Mf..T...,|oJiz.bk....n...G....`:....i....EZ(|.]...B...q........4..N..5.e.....1d.N9...>..>...!B.z.d.x..i.t.>....mkty.....Y...E.E...........?....,.B3...4Q.`..<.@eq...V.?/.a......i.o.i....w.u......m.E.{.m......m{.g.[\-.q./..Z.eF.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4C863284CDA7F859EB300BED16DBCEF9517F1824

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):247
                                                                                                                                                                                                Entropy (8bit):5.061315176047969
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:LQ/Ar9z+LKlXDOLUxGbsH3X8sXWzdsDvLUxGHYz9CVGsDpHHXmXz9y/l:MozSKpGbmX8Qudu8GW9vupU9Cl
                                                                                                                                                                                                MD5:105A01956E71BC8BEFC09641EF0EA77E
                                                                                                                                                                                                SHA1:754110569F45D46571495E1B1C66352CC9A6D928
                                                                                                                                                                                                SHA-256:29ED2263332E177723C2308388AA634E69D4472FB52CE6DD933A971435E142B5
                                                                                                                                                                                                SHA-512:66C6CB64F372FAE0152BA231F425D6F9EF0BACD2C7943D032458C851EBCB699B5616E2D743C515F7981C06CFC3E11680D59DED0A5D263C4E9B2526342F4566CC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..A.........e.me..F..........+....~predictor-origin,:https://www.youtube.com/.predictor::seen.1.predictor::resource-count.2.predictor::https://www.youtube.com/.1,3,1708035693,4096.predictor::https://fonts.googleapis.com/.1,1,1708035693,4096.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\4E020A23E9D40B8752F56867544C8F6CBDA22D6A

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8047
                                                                                                                                                                                                Entropy (8bit):6.042164532306277
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:VmMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEcyLUcELUcK:VoDyuV2Gv+FwEIqSRKcmvwNbZovEn
                                                                                                                                                                                                MD5:3422C387E10F036DC0C39DEB883C3A5F
                                                                                                                                                                                                SHA1:09D1AC82139592E41BE3F2E3002FA13FF306EDC2
                                                                                                                                                                                                SHA-256:EEF2916CD3D96DEB1D309821AEB13FDD3DDDB522A22372E72095876BB11ED6DB
                                                                                                                                                                                                SHA-512:9C46BC6723F0CCCBF2EA64410E26FA406C6CEB4357CDADFD846698ED6D71EA102E09EF41E47F5B20463C790CB9E8AD8CA11CCE6EADEF70356D3BA3522F66150F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:<..f........e.oe.pF./.e.p...}....a,~1708035641,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/top-sites/1/d3698c60-da91-4f8c-b7c7-e14b40be8bb1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB7B7EiQ7

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\56D22C305513B56B77641FEC05EA7399A20703E7

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8044
                                                                                                                                                                                                Entropy (8bit):6.04057766930396
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:YHMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEczLUcFLUcK:wDyuV2Gv+FwEIqSRKcmvwNbZovEj
                                                                                                                                                                                                MD5:E09FC8E10A0F001A4D1B95B6BB5D244F
                                                                                                                                                                                                SHA1:0576799105ABC371F0B7810840280AD50ADAFF51
                                                                                                                                                                                                SHA-256:D2DF43C435B29C7929CC56A246E4839CEEAC314128D36E4BDC403E10DDE64CD0
                                                                                                                                                                                                SHA-512:E3A422F5332C552E68E55CD147CE3BF89F42057B8EE9CB9A933DE248B2C9991E60FF06C77B2CD340F82E3EA2C6055B7821A6CDDAE24C012B3128179B40523168
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:4...........e.se.sF.0.e.s...z....a,~1708035656,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/1bef685a-e82c-4781-8739-d9ec0de152e1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB7B7EiQ7uyD

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\57D27CBCAB857481421F7322F1595A270C0FC474

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):11650
                                                                                                                                                                                                Entropy (8bit):6.04797390631652
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:hFs3i3P0fB7CY+nDyVVvpsy4y/GSwTffbaI8j3qWdtdu:hFs3i3cwY5OyrudfTaIdavu
                                                                                                                                                                                                MD5:3BCE2321DCC0D509CEA012159945CE16
                                                                                                                                                                                                SHA1:8FE04A566712C37D47CE24386B234A615464C2A9
                                                                                                                                                                                                SHA-256:BE16D17F1DE0D6406B39393C841D9900539BE6736399937409E1A612E1C6B3F6
                                                                                                                                                                                                SHA-512:96FF68D3FC58217B73D04504FE109BDF003FBC31475C90BBF1B3D36423B2F06C510FF42AA112416B1625B903F76440E8B69F45C17AA9B4FC0070457A84238A88
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"sort":"-last_modified","schema":{"type":"object","required":["url","order"],"properties":{"url":{"type":"string","title":"URL","description":"URL of the top site."},"order":{"type":"number","title":"Presentation order","description":"Presentation order of the top site."},"title":{"type":"string","title":"Title","description":"Title of the top site."},"exclude_locales":{"type":"array","items":{"type":"string","minLength":2},"title":"Exclude locales","minItems":0,"description":"List of locales to exclude (BCP 47 format, eg. \"de-AT\", \"fr-CA\").","uniqueItems":true},"exclude_regions":{"type":"array","items":{"type":"string","minLength":2},"title":"Exclude regions","minItems":0,"description":"List of regions to exclude (eg. \"FR\", \"CN\").","uniqueItems":true},"include_locales":{"type":"array","items":{"type":"string","minLength":2},"title":"Include locales","minItems":0,"description":"List of locales to include (BCP 47 format, eg. \"de-AT\", \"fr-CA\"). Set n

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\58A756A796A86993036E1F0F79183245EE2ABF58

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:PEM certificate
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):13000
                                                                                                                                                                                                Entropy (8bit):6.0408943034165015
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:HR3u9fiGLm4pUJcjQ/fTTyocqkyTaIdq6/9/x:UBi8mCUJcjurTyocqkma8q6Vp
                                                                                                                                                                                                MD5:00C4BD953FFCF8F2690CF7839E6BC9DA
                                                                                                                                                                                                SHA1:0255CD8EFF925076715FF464B42E9A85DB23B5F5
                                                                                                                                                                                                SHA-256:221CE4F8F6954837DF222B74BE680B7154271908BF8CF2516DC24990A554B5A0
                                                                                                                                                                                                SHA-512:8AF5D5CD0AC6E6595D7A247DCAA9D2837D50C9AF27E729127CD0CFD01A4964DF61DD31491F53965293ACC88C69FE09E68E901BF338E8CE2A4B92E4382FA888E6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:-----BEGIN CERTIFICATE-----.MIIDBTCCAougAwIBAgIIF4NGAGgAoGAwCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIzMDgxMDE1NTQxMloXDTIzMTAyOTE1NTQxMlowgakxCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczE2MDQGA1UEAxMtcmVtb3RlLXNldHRpbmdzLmNvbnRlbnQt.c2lnbmF0dXJlLm1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8.zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7Gffqygmqry.EGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEo4GD.MIGAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME.GDAWgBSgHUoXT4zCKzVF8WPx2nBwp8744TA4BgNVHREEMTAvgi1yZW1vdGUtc2V0.dGluZ3MuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwCgYIKoZIzj0EAwMD.aAAwZQIxAKnhW7gpmEDAerMLSrR9kyCc82//G8dmfBsMJJxS6HNtZJi79sTvtm

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\60B79FC755A9A9CC5C5EC22314FF36964E6CBB69

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):38691
                                                                                                                                                                                                Entropy (8bit):7.668381216280879
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:vbRrJVMvBJMdBEuXKhQfaApQHkKo+pwPo2pn:vZ/M5JcrK40SQqn
                                                                                                                                                                                                MD5:02280762B1DF8E8DA63D9441C558F182
                                                                                                                                                                                                SHA1:7B10B8FAFFF087F6DF34D4C1A1CF48D9FDA88FDB
                                                                                                                                                                                                SHA-256:A135DABF7613895E2C256959C246560AEE151AE23CF8EED4E76FA628B2C97434
                                                                                                                                                                                                SHA-512:0661BD86741C8A5BC5ED4F98C01E41F07D3E16052FC90B13CEB11FB67B04D24C2BC71D0EAF82D1A6DF0327EFBA9C184BF0EE2CD81A0B97BFF2F0D8DDD1422BBB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.f&....z.4...X.}......./.t.rcg.TS..s....!......%b.ci..R./. eY.u..&\..&.d...$.....ro.v7P...z....I.>.....Z..].u7 =...AR....K..J...#.lK..[.p.mO.!...w... 8...>d.h.[.5..eh~....l.L3.!=.w9.5...j.... .c..k...%.....K..+.7..N}.wQ.5...l....9..7G?.../c|f].Y..7{!S..'9...+B.Y5t.#...5..M.dp.> ..;^nD....0.D.a:DI.a..(.."v......|.7..5...tS.....d.5u.:.(.~k..kA.OJCU..Rb..6...\..$.E]....+..w.^7k... .2.l..y..^..&t.f...k.^.....?0`V9y.f..M.X./...u.:...`.*.k$IN..!..U.(|.%3o.......a(DZJ[...f..-....g*...An..E3.~....O..m.hI.RH{......*...w.R...Y&.....@.I.p....b.'.o....1@....!.dc.Bw....Q.$4...kAc..AR.`.)J.....S..k.I.?..wb..Fx....[o.j.rks..l..E.z.9.#y.o\...m.1~...........l.v.8z...3X.g[.<.<X..4..*.+6Z.......jq,..nD.2'...^!|.d]........i....o.__.....Uo....u....i....^h. p.+T.4..had.a..?......7_S.Qx..........W....`I..\v...F......6.....c[...=...{.,.&.(....2..g.T<y...r..zt}.U.[.F..pH.,~.](.........r..m... D...3..~.o.w....8.Y.j2`........&..... p$.v.......wOY..........

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\61E7BECCAE8549715CA725B2D3E89C2E3234FA06

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12848
                                                                                                                                                                                                Entropy (8bit):6.0157350553396025
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:IFtHVrWJa3oac8LCBlm+nDyVVvpsy4y/GSwTffbaI8j3qWdoda:8HVWJabcoj5OyrudfTaIdaAa
                                                                                                                                                                                                MD5:A4E64124F9E14F528BB84568580A84E6
                                                                                                                                                                                                SHA1:5551C02F20DC02B8A4811FA9A3D15D83B2F5EA8E
                                                                                                                                                                                                SHA-256:FBD3E61918F1CB3A864C4694FDF55FB3118A8F8BA431C4ED964CA4BC46305C3E
                                                                                                                                                                                                SHA-512:017E72C52CCCC3CFFCBCA8A3D146CBD95B48A7E5CC6BFF0811934CD56EA3074F8DBF24716F4CCC6779036266B08FA4603DCACF50F7E597EC140BA8D89EAE41D5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"sort":"-last_modified","schema":{"type":"object","title":"Gfx","default":{"os":"","vendor":"","devices":[],"feature":"","hardware":"","driverVendor":"","driverVersion":"","featureStatus":"","windowProtocol":"","driverVersionMax":"","desktopEnvironment":"","driverVersionComparator":""},"required":["os","vendor","featureStatus"],"properties":{"os":{"enum":["","All","Android","Darwin 9","Darwin 10","Darwin 11","Darwin 12","Darwin 13","Darwin 14","Darwin 15","Darwin 16","Darwin 17","Darwin 18","Darwin 19","Darwin 20","Linux","WINNT 5.1","WINNT 5.2","WINNT 6.0","WINNT 6.1","WINNT 6.2","WINNT 6.3","WINNT 8.1","WINNT 10.0","Other"],"type":"string","title":"OS","description":"The operating system identifier."},"vendor":{"type":"string","title":"Vendor","description":"A vendor identifier, eg. 0x1002"},"blockID":{"type":"string","title":"Internal blocklist id","pattern":"^g[0-9]+$","description":"Original block id, eg. g28"},"details":{"type":"object","title":"Details"

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\6246CB7FA0A72939616FB877FF3FE3BF71EBC1BB

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):133
                                                                                                                                                                                                Entropy (8bit):4.985765007790187
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:+Ul8lh/BOrV/aclEtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:+Ul8H/BsmiclpJWw9LYX24Ztn
                                                                                                                                                                                                MD5:CA30C18092D910F56B01A94D03D10DC5
                                                                                                                                                                                                SHA1:AEF76CEFB8194FAB1E3276F0EBB97F8B096EE400
                                                                                                                                                                                                SHA-256:79A8C3AC89C5A32DCCC51B582D6FE0A9CFC9AD90B067244E9AAFC4AD5B416C4A
                                                                                                                                                                                                SHA-512:79D62E5FDD7781DBB625FB23FC8C6AC9657C47B0F0CCAD0450C491966727A64D66E8B71AE695FCDF679F1223507F42F34F44DB5BFE7B6050388C268C2795BD27
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.jT.........e.de.dF./........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\65E0FFA59D21ADEE5C3AA36A5C3162271566AE23

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9549
                                                                                                                                                                                                Entropy (8bit):6.105974429970992
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:wcT83BB3K+nDyVVvpsy4y/GSwTffbaI8j3qWdPd8:zTKDK5OyrudfTaIdal8
                                                                                                                                                                                                MD5:543C5165BF6C4D7A602FD9530163B5DB
                                                                                                                                                                                                SHA1:B5B05F9C572E7C111EC1AF14AA91C4863BED839C
                                                                                                                                                                                                SHA-256:16967485C40DF4D6BA067D26894E51D235733FF8460A33ABD8329F0A905CF34A
                                                                                                                                                                                                SHA-512:7F973B1D6F22F9B9687A847DED23C22927A2D9F1FB176056B7A7BD80BD47157C586DEC75647779023CA65B24BCF3AF4314C3B9AA6DA00D3ED4393FCDC4790A43
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"sort":"-last_modified","schema":{"type":"object","properties":{"name":{"type":"string","title":"Name","description":"The name of the device (e.g. Nexus 5X, \u2026)"},"touch":{"type":"boolean","title":"Touch Screen","description":"Indicate if the device has touch capabilities"},"width":{"type":"integer","title":"Width","description":"The viewport width of the device"},"height":{"type":"integer","title":"Height","description":"The viewport height of the device"},"featured":{"type":"boolean","title":"Featured","description":"Whether or not the device will be displayed in Responsive Design devices list"},"userAgent":{"type":"string","title":"User Agent","description":"The user agent that will be applied when selecting the device"},"pixelRatio":{"type":"number","title":"DPR","description":"Pixel ratio of the device"}}},"signature":{"ref":"17jw58li0pidixjjpmb6n8260","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\672092B8D36D64EA59E40AC662BE04092C353FCC

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):17271
                                                                                                                                                                                                Entropy (8bit):5.946734219529097
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:vBYt5hUyp92mDWsPRTDePmcX198A+nDyVVvpsy4y/GSwTffbaI8j3qWdFdQ:M7DhRTDa198A5OyrudfTaIdanQ
                                                                                                                                                                                                MD5:A10C0E606F889684965425F37C641222
                                                                                                                                                                                                SHA1:8975FD6AEED660254A53C43A2510CC72CBCF77A7
                                                                                                                                                                                                SHA-256:BE6142E3B7FC7B4A299039B70F6B17E0DFA35EC3F137EC0A4915B57866219C59
                                                                                                                                                                                                SHA-512:BF8078ACF63D8854DDC68D84EF7778F419616ED1DC7AC98628115E668C17BFAA8B8170DB20EF1E66948764409770D08948D7FD511E97DC043B96626E3F6D0D91
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"schema":{"type":"object","properties":{"attachment":{"type":"object","title":"The attachment itself","properties":{"hash":{"type":"string","title":"Hash"},"size":{"type":"number","title":"Size (bytes)"},"filename":{"type":"string","title":"Filename"},"location":{"type":"string","title":"URL"},"mimetype":{"type":"string","title":"MIME type"},"original":{"type":"object","title":"Pre-gzipped file","properties":{"hash":{"type":"string","title":"Hash"},"size":{"type":"number","title":"Size (bytes)"},"filename":{"type":"string","title":"Filename"},"mimetype":{"type":"string","title":"MIME type"}},"additionalProperties":false}},"description":"Information about the attached file.","additionalProperties":false}}},"signature":{"ref":"20crxvapq0ey22q46vbomp9qde","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"-fFx2lu100c4E7TZuWZw-cihVAUy2b6f

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\69455E9F6ABEDFC78866EDEA94CB9D51C573A013

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):126
                                                                                                                                                                                                Entropy (8bit):5.027764674501621
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Vh/BOrV/acll3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:Vh/Bs7Riclp+OGb9LUxG0OKLtn
                                                                                                                                                                                                MD5:20FA252EB4D84F8CD4F32CA40DCF19CF
                                                                                                                                                                                                SHA1:A0D5E60800AAC1BBA2BF4A0385F240445F89C510
                                                                                                                                                                                                SHA-256:ECF01E1EB5AEC09A220F47D3228FBEC78D3EEC4A91A87359F091B902C0365831
                                                                                                                                                                                                SHA-512:18332F2B9FFE909FBB0D6B640850086A974BF2F23E812B0EB7AA23653E9C9F3512396ED75870AF5034C6D2C10241482DF496552957A0A686F326FF012F444F3A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:UD&.........e.de.dF./........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\6D264199C0FFF3E48A90A48416AFDAA75380F257

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9263
                                                                                                                                                                                                Entropy (8bit):6.115548577318181
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:XIoBRClC+nDyVVvpsy4y/GSwTffbaI8j3qWdLdw:XBCc5OyrudfTaIdapw
                                                                                                                                                                                                MD5:D4DFFBD00DD8C3583CDD353F89CFC9A2
                                                                                                                                                                                                SHA1:5F55ADE6760B05251DE0086ABF161CD1B7838CDA
                                                                                                                                                                                                SHA-256:53BF687E158626DDE4187158D42F993E31AC25699A38F25FC11D3B50D63ADBAF
                                                                                                                                                                                                SHA-512:551B3027702726E1B44B5D07FACDB9F32D673141D9FD7B7B0607FB8DE3D20473EBA178E4FBA64B444AC8117B693BD904051EAB8D13ECCEFEE9A9A6C02E83C188
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"schema":{"type":"object","required":["firstPartyOrigin","thirdPartyOrigin"],"properties":{"firstPartyOrigin":{"type":"string","title":"firstPartyOrigin","description":"the first-party origin being used for the permission."},"thirdPartyOrigin":{"type":"string","title":"thirdPartyOrigin","description":"the third-party origin being used for the permission."}},"description":"an exempt list that partitioning will be automatically relaxed for specific origins."},"signature":{"ref":"2jdvp4amtrjhq32s6fq1ojpdm8","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"YA5WqXr2k16kPB4Z4TnbfNoBZAI5yVaL9vMNOO3JreDLp7PlKItPdJaTUWAJV0E1X-nUi6UPbA5coNv03sD_-qZbiiXlmlg6igBmEvQe2KF3mVsKGypbfLa9NWZmMq4M","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:gzip compressed data, max speed, from Unix, original size modulo 2^32 4228120576
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8888
                                                                                                                                                                                                Entropy (8bit):6.6634813806716195
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:8h9cQuDxqvy3OybYtvy3OybYuNbZovzcdXY1Mld4Y1MZ:8hWDQvyhb8vyhb5AQXVH4VZ
                                                                                                                                                                                                MD5:2D315DD79597B11EB3D20C74D6BEB6CA
                                                                                                                                                                                                SHA1:C92C8E313FF52E638F05BEFF691FA68F6E02FF36
                                                                                                                                                                                                SHA-256:86CD5A0175A1D2767514CD8D622C9E9436BBB5CD67CEC6F6DDDEC5C86AFD6056
                                                                                                                                                                                                SHA-512:C6EA9FFA2A1A3B453A5EEF9727622B4EAA4ABB230215F4D5F131601FE184AB41D63C0582A6A19100F39A56604BC22DD128A778EBD707BF9278D7C209FBCFBAB6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...........k..H...........t..x..Am.....(....BQ'.....3..M.....u.[....Z......R....s....n.k..V.i..c.....<..e..K..mr.T..G.O.|..=i.L=..c./I...V....\..E_..,HP`.....|F.d({.....s..Q 2B=.\?....>.C.Y~...C.........A..{TdO...p.>B.0..o...../....#1...:...@I...e:\........].w..6..... 8?....l.a...nn..v.HW.....T0x.k...g...$N.6.rmk.dY. .Vo.Hx...2LU?.1...N.....K.H..!z...M...t;R......ml~.K.....^.....K4..hr3.'...ttU...;aO.jy..U.<:."R%{........X:.S%.>q]4...g~...,N...h..n..l.I>.9..uY.*..{......=q/.`Lkd.'.-.h...<.y.H'...c..4.KK.........Me...CU.Z..T.!J..s=.o.V..5.U.....[.S.....&.qo.L...G..&8E#../..p.7..6......w.,.O(...z..sk.|^*.9......'E.....ey.d.":..f...2.......N..,...)...+.).......bj.?hu?7.ND`27.=.p\...k....`..w.....F.#...ElQe.9...X....X~..^f.oX(....{..|.].$."7.8].&u.......'...&`....e~V..F.....i(C....Q.(...xt!.eI...a.."d.`.A........... zp .@.C.. ..............#...{.....7...F.)^....9.tcm....;.9...."c....d.w.d....ND=$.w?.\.6.7o@.......F.M.9...cG...F.B....SM......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\72C864DA4771540A2D18DFB61D8BFD85711C852D

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8054
                                                                                                                                                                                                Entropy (8bit):6.040098702324626
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:wwMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEcoLUcmLUcK:pDyuV2Gv+FwEIqSRKcmvwNbZovEj
                                                                                                                                                                                                MD5:3978FCA0C9F9DA52F675AA3164E4D833
                                                                                                                                                                                                SHA1:5890AB37E73B340630304061AFEBAF668F6B1218
                                                                                                                                                                                                SHA-256:3A96A68A3FDF800BC00402D81D22B1DA8BC7F6AF28B4EE6E240DAD5FB99EE436
                                                                                                                                                                                                SHA-512:F503021B56F6FE5101AE6685EBFCDF0F90CE045426F68CE61ABA3DD4227868CCD45D042F063804681533C92EAB3B04B1B372AE8A42D08EAD38981887491AAED0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.QM.........e.qe.rF.0.e.r........a,~1708035653,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/b3e287d1-bcec-4242-9158-4e1296363490.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\7943793AD6EF12CA229A1DF7A721B44C210BBC82

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32390
                                                                                                                                                                                                Entropy (8bit):5.584275397813934
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:4AyCFAhcvLYPfOOdFHigzNfw4CNHQ5OyrudfTaIdaIi:4r3G0fnkgzNfyHQ5OyruJa8o
                                                                                                                                                                                                MD5:53A09F655E490E6AC948335874D51FC4
                                                                                                                                                                                                SHA1:86CCA91F00A9A0506CA4D2B27832DC37950BC6C5
                                                                                                                                                                                                SHA-256:D57D2DA11900E47B8615CAF2E0F5F91151C6E8D55090A638A28EE745E90B6A6C
                                                                                                                                                                                                SHA-512:E699AD79C1CF1C3A485752E94A022A7EAA4B63B9947F9ECE07F888526E6ECEFD19A0BC35934B8D78B120E51C7E2771C144F143C97D034759C8C32BA76154CFB2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{},"timestamp":1708032635406,"changes":[{"id":"c521b443-368f-2e18-a853-066abaa1e9e3","last_modified":1708000561099,"bucket":"blocklists","collection":"addons-bloomfilters","host":"firefox.settings.services.mozilla.com"},{"id":"0e543556-43bf-3139-1fda-2a0068116c6d","last_modified":1701990003977,"bucket":"blocklists","collection":"certificates","host":"firefox.settings.services.mozilla.com"},{"id":"19e79f22-62cf-92e1-c12c-a3b4b9cf51be","last_modified":1603126502200,"bucket":"blocklists","collection":"plugins","host":"firefox.settings.services.mozilla.com"},{"id":"b7f595f9-5fc5-d863-b5dd-e5425dcf427a","last_modified":1604940558744,"bucket":"blocklists","collection":"addons","host":"firefox.settings.services.mozilla.com"},{"id":"061d4584-acd0-fecc-b5fb-dcfe0ad5e123","last_modified":1624388514784,"bucket":"blocklists","collection":"qa","host":"firefox.settings.services.mozilla.com"},{"id":"3fadb169-e5de-a2f0-374e-6eeb3eac3dbb","last_modified":1692730580117,"bucket":"blocklists",

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\79B11E5B2A73707AF920FBB504E5C456E1698B13

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):15844
                                                                                                                                                                                                Entropy (8bit):5.969763751075597
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:m7VqN4mApqN3Xo70tNo+pwPm082nyFz/i5Y:TApQHkKo+pwPo22
                                                                                                                                                                                                MD5:C098238115A094C09BF441CDBC1C9061
                                                                                                                                                                                                SHA1:58B286597A95A6A49CEC0FFB04154A1F0CFA4924
                                                                                                                                                                                                SHA-256:2CE02690D45267943A1FE5E629209B0B646BAA178DD7BC49CA4ED2ABA9EFB8FD
                                                                                                                                                                                                SHA-512:7F4F4C25134A54618914B68D8ACEEE0528452F7015BB6A076D95D7C88D609C532FD11C53F668362612865754CD4220C22806FE48922CFD1DB53B7B1E50AEA784
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:................e.mF./.e.m...E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.strongly-framed.0.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA5iMIIOXjCCDUagAwIBAgIRAJKc339ZwIrpCZuMyXFusEowDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxEzARBgNVBAMTCkdUUyBDQSAxQzMwHhcNMjQwMTI5MDgwNDQ3WhcNMjQwNDIyMDgwNDQ2WjAXMRUwEwYDVQQDDAwqLmdvb2dsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASB6wVGdBTGrYTNLOgcSDG0+J3gPo8rFeHbl1W+ZIBjbbIlAbGtcHWlO5LiWvX/9Ra4EykTj2Z2HH1qM2RuWespo4IMPzCCDDswDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFJDWIvFi4WYw5Ts43/kaYiM+0kSvMB8GA1UdIwQYMBaAFIp0f6+Fze6VzT2c0OJGFPNxNR0nMGoGCCsGAQUFBwEBBF4wXDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AucGtpLmdvb2cvZ3RzMWMzMDEGCCsGAQUFBzAChiVodHRwOi8vcGtpLmdvb2cvcmVwby9jZXJ0cy9ndHMxYzMuZGVyMIIJ7wYDVR0RBIIJ5jCCCeKCDCouZ29vZ2xlLmNvbYIWKi5hcH

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\816B6F4E6B13C8066B81DB4D46EAA110CAF2BBD1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):62475
                                                                                                                                                                                                Entropy (8bit):5.748752207872221
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:ZiBsf51AkSAoA3ABAkWAyaUAtAm/vAIlAX5E95M2+eANRAkDAkfAcAsA0AJA5ABY:ZiyvAkSAoA3ABAkWAyaUAtAmnAIAX5EQ
                                                                                                                                                                                                MD5:CD74D63DF11AE5320D10CBC75C5A9F47
                                                                                                                                                                                                SHA1:1D8A767B0ADF3AF279132EE6AC48D859DB579819
                                                                                                                                                                                                SHA-256:802BF32F3EA84CF3D81E6D25E88556114B3F9D9614ED2AFAF5F4C884F8729F02
                                                                                                                                                                                                SHA-512:7F2F2FA19B2AB8271FDF3B2D9E733500A3EFB9DA2E5BC2C3876DEB937475834B069FEDEFC786CC2F82D9413042C859759A39CDE86501FE3DD9E14C6E8FC86AFE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"signature":{"ref":"3mi6habjd8cr824juvka7zz6ak","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"9ON4-LibANPXeZO1gMmGvWZW5nOsHsCdE9Fmv2mZ01HxiL4-xTX0avjL1wNQrLSNOZbOx1yE6xxkmWcBYOz6kTDw3liuONT6dvg7-i8VP1eqOKbgmNMRxR668wSpZzc3","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"displayFields":["id","name"],"id":"normandy-recipes-capabilities","last_modified":1707955270277},"timestamp":1707955270107,"changes":[{"recipe":{"id":1235,"name":"Heartbeat: Daily Viewpoint Survey (zh-TW)","action":"show-heartbeat","arguments":{"message":"\u8ACB\u586B\u5BEB\u9019\u4EFD\u7C21\u77ED\u554F\u5377\uFF0C\u5E6B\u52A9 Firefox \u8B8A\u5F97\u66F4\u597D","surveyId":"hb-dvs-zhtw","learnMoreUrl":"https

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\82389E844E9ADD05DCCB19E31E5C3A8481D7680B

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:gzip compressed data, original size modulo 2^32 620692224
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):278100
                                                                                                                                                                                                Entropy (8bit):7.990693788038138
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:6144:q07Y4+1QlksDFz/wCjD3CrdgOKOzCnwGi8DluW1I0:qCtPHCrhoLDP1I0
                                                                                                                                                                                                MD5:4E3FF26BB4220080B769225D24DCE076
                                                                                                                                                                                                SHA1:7CEE478A585B18DBA8344E4A68C6487F0AE2B9E5
                                                                                                                                                                                                SHA-256:C6084CB0BDF0A12A7E13A71914D8EA1E28C25C16F2E776296270EFEB34A95388
                                                                                                                                                                                                SHA-512:E23BC53C2E161275488DA32A3D15B908A7B7EDE27DA08DFB871266D3C173059B47C3541AB1313D879FCF3020826B94729BBF32A4FBE09C29C2FC57B966691184
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...........Z.n.:.~.h.*..vD...o..\....d...M~...#.C..B....R...o-......$2WR..e.Fqv..\&o..%FAB0...-S.P.\...<.z .p..(a.7"N@X..?....z.!T,y...,...H.),.[..1..x.E.t...Z..K.H..Y.q]XH.........'..ez.u.l..ox.W...h...aC9.).).....nO. ...9....9.KH.......V.eG.j.S.......?..@VWZV.a.g.G.9..........E)b!...V..N..cKy....:a..+.K.O.H.u.....^_.t5.D.@;......f.by0.[.h..Om @....f.9...O.<x.S.o.....8Ge.....0...;...[LS..o...W...-..X...{..(..9..8....JC....wB..f..h....s.G......C...D...[.S..p~....U..NP..b.....!Z.t..(.K.e....G.Q...].7!..S.}/u.K...=.....~.z<.."....-..w....!..........f;..;.@F.RL..d...u1.i...'.;w#...y.`Pl8...S.FrL...TV..c|Ri-\bTM.r..."..%.X.D...........KP....z{.E.Z.1.wH.L.........R.eQ..X......\K+..../....i.0..V....b.KCN..B.....!O...^.h...$x.K..W..$X.$.....r.......|c.(.9..u...1.>..$.K.B..9.@.!.D1.D._..Q..}y*.z.r.'$.(i.......:...jv.&. T...D'5...`t....0...u..A2..{....../i.v...M.....O..D...p.=..l.Mk.........I..^..<....Q aJ..).d...2.r.....HI].D................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\850BF1C04CBD99F930EEA6286E5D2CC00CAB27D1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8044
                                                                                                                                                                                                Entropy (8bit):6.040354587236398
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:yuMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEcbLUcpLUcK:DDyuV2Gv+FwEIqSRKcmvwNbZovEb
                                                                                                                                                                                                MD5:4B965E646204169943829A27611F528D
                                                                                                                                                                                                SHA1:75EDAB3B628973CCCA68D168E3079B9AC8DDDA9E
                                                                                                                                                                                                SHA-256:68A5C3D60F5F731866E6D7B82B61730D3BC934B616D099388CEE9A4829FE05C4
                                                                                                                                                                                                SHA-512:CC5F2F7136AF656D8610E1484D94E55413C6A6217EE40E6F7D46B8B579BAB76CA489B351129DA0F72E78650377805E3C5229638E450C62C6920A08BB6B7411FE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.7..........e.re.sF.0.e.s...z....a,~1708035655,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/dd74a7e7-e73b-4ab9-8964-ca5c53c60966.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB7B7EiQ7uyD

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8890A1FFF6A635F3C1D09180CF09237EC3AD1C08

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9015
                                                                                                                                                                                                Entropy (8bit):6.111823020345343
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:7Bzc45+nDyVVvpsy4y/GSwTffbaI8j3qWdjZdjY:j5OyrudfTaIdan8
                                                                                                                                                                                                MD5:6E9546B1AF9B9E6EAD2622B278F9071B
                                                                                                                                                                                                SHA1:749C77586FA0075E07C7110C4C0987C518DD8D69
                                                                                                                                                                                                SHA-256:78D830326A1D0095062C3BC289A64E42241D82C79C34329F2DD9607DAD9976AB
                                                                                                                                                                                                SHA-512:8EC7F70A1042AA45215FD7FF6B702F8F3CB9EF8DED287EB63614DE931DD81571499B53989232D3C79CD7B66C96A5BA647413FAC745B1E9EF560DD5652DE095FB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"sort":"-last_modified","schema":{"type":"object","required":["name","version"],"properties":{"id":{"type":"string"},"name":{"type":"string","title":"Name","description":"The name of the language identification model"},"version":{"type":"number","title":"Version","description":"The version of the model"}}},"signature":{"ref":"1bhsli15uizuj3fstgi3eu3u5k","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"w1VUrNCUOBedAWcX5tNrRaI6K3kiGGhnJb3lmGoOfURHVcT4JDQSFAzvHXa3Ed0U0k_2JOPoU8XsGTtWpjLKwHETAA3DTs173t4NzFKJDrAf7T3mhi0oE5YzL3yZIzDJ","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"attachment":{"enabled":true,"required":false},"displayFields":["name","version"],"id":"t

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8A4AD299B2F0E55A552D3CB09E7A57213CF46041

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9273
                                                                                                                                                                                                Entropy (8bit):6.121282679050704
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:mcGBXND+nDyVVvpsy4y/GSwTffbaI8j3qWdP4dPF:PI5OyrudfTaIdaY9
                                                                                                                                                                                                MD5:19268AE4523B55F58F065D3FF47A1B5D
                                                                                                                                                                                                SHA1:3B1FD0F4C0C45AEFA624DD198161FA97AB55F314
                                                                                                                                                                                                SHA-256:0D251CED1F77ADD17A522792C63C314E56628B7A798D3A13978572857A92F75C
                                                                                                                                                                                                SHA-512:402A15099839F358647F3671D3AF0EA3B77B07E4E969BC710C50B1773D3DA42DB350423B0BAA738087BCB64331BB6440ADAE69F7952643E54BEF8704BCE7DD78
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"schema":{"type":"object","required":["pattern","feature"],"properties":{"feature":{"type":"string","title":"Feature","description":"Which feature this entry applies to (e.g. tracking)"},"pattern":{"type":"string","title":"Pattern","description":"Site hostname pattern to match"}},"description":"Skip list entry for URL-Classifier features"},"signature":{"ref":"38th307vhqoa81t3yxog2sgkoi","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"sscaeO2PWi67CY9j7RPanz4Xa_1dMDvk4CzbvIU3sxCK7lj0enn_ZwvXGQugdkC8tf4FV_8Az7CgvlWMAV1g4M4_iUU-YeAj9sOLvzBK-hydOFol4qhroMwn3nmgPFGk","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"displayFields":["pattern","feature"],"id":"url-classifier-skip-urls

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\8C70B6E8D37C1782EEB61CEDADCC8F4F729EC4B9

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):17431
                                                                                                                                                                                                Entropy (8bit):6.426304639153737
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:Tep7VqN4mApqN3Xo70tNo+pwPm082nyFz/LWJ:vApQHkKo+pwPo2d
                                                                                                                                                                                                MD5:4D1EA22F23B387DC237D56D383E3D1C9
                                                                                                                                                                                                SHA1:0AE39ABF2A63C313058768B45F7DDF1DBB7ABB3C
                                                                                                                                                                                                SHA-256:0F638612567C21A9697215EA9E321B5FA05893AE28BFF6462B0767D7B7541648
                                                                                                                                                                                                SHA-512:7A798AAA2F822D97D3BBCE65FB6AB71ADEC8C237AD2CA0D80EB3ECE45CF4CDCBC91D85FE4726B9F5F84A22CE619513BEB1152768B320EB5497A4FE85B5D58E53
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.0.. ...s9...Ie..].&..y+..8..Y...(..'..w.O..wU....R..I.@3..7.{%rx<.C.u.Q..c.6o..X.3%.K..U.1....IP..Y.~.fW...V....Oe....YX.u.x..(.H....SY...u..mv.."./..d..(..lT.J....K..j...:L"..C.N.M`.=(`..=+..@....!0.g...*.....H...u.^.K...P.._.XYk.)......>Mb.miv.+...<...e.#.1.^.....W..1...H.W`.u......0.mR8J.x.+...w...0(.S...../.N.G...7m.[....`.&.-.*0.Bwe;.6`.(.H.?.J.,..qt&..Z...;. a...e".q.f....`...!.F.<..$C7tY.d)..M.?.h.s..4._....C.....`.){..3.....w.3.....a...-n..u.CY'....3.(J......[.q..r<..Y...l.k[:.........s..1.>'.E7..z)..N$..k.=.tE.6.i..Ez...N..eY....c..../|.C.%...s... ....R...o.4.o.Rp.".zd./gz].l.........u...A..&....8j-......|p.U...b~.y6.{o...8.E..v..O8.?...n..h.v.w.c.9j."...k........MW.cnnM...M..5a.u.....*.... !...,..=..aD h..Ms....[.<.M....uD...3...pR..y.=^........Q......t.[KA....x..|.........Q{.wNn..............9..U....!{[.G.Y1.....Z..)u.i0U.7y..6.W.'.....?.....$.....1....V..D.E..Ia,$..P..PP.F..O.,X.=..0.G._..-........o.sn..SI.....t.y....c....Vp......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\9785C9F119DFF432C69AB44AAF6E4AC3DA338708

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):146331
                                                                                                                                                                                                Entropy (8bit):5.2986514528106285
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:n2izZWUdYJlFQgC6zVh7YGzOh0Rc04zNUHN8v:2KwgIoN6zVh+0Rc04zGN8v
                                                                                                                                                                                                MD5:4F346AB077CD42C8321100AAAC0C028A
                                                                                                                                                                                                SHA1:A5C048CE6DE8ABE0BFF21518D401AE5ABDF55BA2
                                                                                                                                                                                                SHA-256:58F49A68CE07B1BB3DB1AD4EDB0426625EE779730D1EF0655B8F9A00AEB2FD00
                                                                                                                                                                                                SHA-512:B0B25F332C145107B00BA9B48C0EBA68C8EA165E2F3DD287E5ACEA6523C70D51AC1B76B6D61401457D4E14DB73EBF9CCF96DA5E4E186A114E485C5560762ED49
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"signature":{"ref":"3e1x8vsr7yoq71kllbhbfvfvjr","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"4Wl-3ThzoUADIZuBoVQ8ECHjb0fu7FU0ejEpFmVYogm_Qnn44cNTolGi-wfcepTRNgzt1g697om7DqoxnP8daLyjZWt1xTNGA5IfwWDNhZPKe8eKU6krgPRlLopZ4SRL","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"id":"nimbus-desktop-experiments","last_modified":1708032841474},"timestamp":1708032841230,"changes":[{"slug":"address-autofill-desktop-pref-release-rollout","appId":"firefox-desktop","appName":"firefox_desktop","channel":"release","endDate":null,"locales":null,"branches":[{"slug":"enable-address-autofill","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-suppo

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\97AE667565B6120DDEBF42730CC21468FE5AC36E

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):103
                                                                                                                                                                                                Entropy (8bit):4.684277111265084
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:yb8+II8PRaalllrlljXvX3XDkySLYXqhJX8sX3u+llln:ybH8PR3LXDOLYX2qsHHl/n
                                                                                                                                                                                                MD5:EE7CFBD2F0C72E8D7A57518725D8E0BC
                                                                                                                                                                                                SHA1:5FB679500E5206103A85C71B9AEA8D9F4AE62786
                                                                                                                                                                                                SHA-256:EDC81C8BB77B3D8EBCE03581191627EF667A68D819B25816FE7AA167E7D7090C
                                                                                                                                                                                                SHA-512:FD94DD674AC22E7AF0189EF27BF64A645D1344B85C952B979DA8F1789A0E30E87BC9CDD8967711530E6BA3953B76CE6148894D329F851BC190DA11E734792631
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...........e.me.dF..........,....~predictor-origin,:https://www.facebook.com/.predictor::seen.1.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\99C6C0301A7D0F8EAD0703C927C869387A84308A

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):19440
                                                                                                                                                                                                Entropy (8bit):6.761950344578521
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:x/mBQK9Bes3PiYZ7VqN4mApqN3Xo70tNo+pwPm082nyFz/Lln:xwQFk6/ApQHkKo+pwPo2i
                                                                                                                                                                                                MD5:3DD0A95C7C276D02DEE1511858A40554
                                                                                                                                                                                                SHA1:D2E78CB2B159E61EBF33773F1EEA49D6CCFA5219
                                                                                                                                                                                                SHA-256:159D8425E971CD8169BED7442A5911F8EBCF3C9DE8868264A8772AE6B3CBED91
                                                                                                                                                                                                SHA-512:1A1CF84D5F7DCA5529AEC2FF4722BDF959B95C3247FC4C4723E9B26D9CB51A4FCD5A67DC623C5C1B11A1E7CEEC1E605A0C395E66A43C2C14D8ABFBD80B29875E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.H-. .-..?/.C.....3.,J....u.EQ...6..`....K.g{. ..4.....t...j.Z.sk. ..t..'x.|...e.C...!.6U...LQ..6.4.......P......i..]......i>.&:G%..b.......<.d..Q...A9.c...R..f>9T...B...YU...~7..:......F....z.MH..$.... .aU.V.fg..b....H_H.R..U.........P%L.S)......)...oY....!....< .....D+.L.....|Ew.f...n}...a9...).5...e}=....iU-+....|.H.o..M..N....^.$C...NU..4.k..I.7*....O.'.b.w.....-B.r.X.....i.6u.'...W.t.6.L.4".mB.9.S..h8..V.ltZo*.('a$.#.Q4....}g...vn.3&....[90..(p....<....3.Gw.>.......\.l..Q.7.+..P.".m.......ve.^.V.r.M..j..~#CK...U..}.........U.[....jl>...M..um......YW....-.@.A...a..tpa.{......v......"s..B....0.t}G0Z..{.x)...3..\.5..mb.!.E..9$^..l....].I..`...i{`..r..r..&.Y.QNl}9.2.....2Y..-..0`vHL.w7x....odcHV...r..L@..Z.).0.&....v$.+.. ..9..M.0.F2..ei6...(f..N...%.?`.z..;......4...m43.,.`......C.d......).$`..h|.k..&l3^...6.^m............l.. ...y[N....Ya.u]m.J....x.9.w..i..s..F..w.c......j.fLh.m...1B|..Z..?.0..Op\....W..;.$...4D..Xn..r...,dnT.h......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\9A264EFEA14C043A84240DE25C759F48DC6E10C3

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9331
                                                                                                                                                                                                Entropy (8bit):6.1289561310515355
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:qxMJB+duN1xT4CG+nDyVVvpsy4y/GSwTffbaI8j3qWdph4dphU:qK4P5OyrudfTaIdapmp+
                                                                                                                                                                                                MD5:BD5B06640C9891E0AF14AF51BEED2673
                                                                                                                                                                                                SHA1:F30D0421AA304202E55849FD97ECDA1BF73BB717
                                                                                                                                                                                                SHA-256:C16ACC4266EA8D45ACDF997ABF2E595DB861E45C7307CB346435D4D0650B68DB
                                                                                                                                                                                                SHA-512:CAB92CCF5E83CEBD337B304FF1C0F8179DF8276470AFC5E85B3AF89E982C810CC400E3B93BED6B654170EE7F344F82461C09FEB3AE06EC74EA3E556CD7AD7B87
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"signature":{"ref":"1l0sixethnixd3w2y2lj1o4dyw","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"yO5dKeqqnb7ECkdhtj_-1eGISX94VX-YUEfDESTIRllnL3TDcMvzKE7VALUUcQ-FdTiBpVuaNL_wtviA7dYh5KlxP5-2P2Jq-Q-Zk7ejQYKkjKB4yO6Zx9_vppC95fEp","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"id":"cfr","last_modified":1707609605870},"timestamp":1699046525260,"changes":[{"groups":["cfr"],"content":{"text":"","layout":"short_message","buttons":{"primary":{"event":"PROTECTION","label":{"string_id":"cfr-doorhanger-milestone-ok-button"},"action":{"type":"OPEN_PROTECTION_REPORT"}},"secondary":[{"event":"DISMISS","label":{"string_id":"cfr-doorhanger-milestone-close-button"},"action":{"type":"CANCEL"}}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\9C6671ACE420DE676A22969A7EBCECE331B9A23B

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):21332
                                                                                                                                                                                                Entropy (8bit):6.984109671998828
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:0bh+WVteP4/KlI97VqN4mApqN3Xo70tNo+pwPm082nyFz/L6p:qhBKlHApQHkKo+pwPo2X
                                                                                                                                                                                                MD5:FFE2700FDDBC5CC82D4F1B7191226B74
                                                                                                                                                                                                SHA1:BB24E2367CD0C3118C9B8FFE68A3AFB4E0BC65F2
                                                                                                                                                                                                SHA-256:E8872ABA0843D03989F0CEE493F482CA1E2E66F4EA2770F28DE36BEB88403658
                                                                                                                                                                                                SHA-512:7080B23895201AA14B645A7E3181122210778EED16CF40E5F0506DE434453F9D2759803B306D2E27F2685BF989224B02D9708D936C4544319263C0E9742939A1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.p.. ..R......L...Zm).....*.q.;...a.uz.".. ../...08..k7...ZW.;....v.t.=...$.Q.A..D.........?..~..W.e..k~H^.f*.>`.D...?.....,y..#"A..3...=1..c.ju.q!.....)e&I.)../.i*..FV....d.mC.;...~.."r...*..O[.WH.i.P.A..]G{...q$.2...Z>.4e&G...z..&.....D...M..L..wE...xsI25}&...#...+......\......N.3>.bg.MWAX....D..z.Xv..}......;.y.<B...:5......h..2...;`.G...u.o5!Q[.b..kw..K..3...3b..,..?FD..|>.R..7...(...p.M....}n...ZXI.@.j.!~!....9.....i..v...f..t..........S.....0.....4.')/.U}....=....1........a....=..'..0...yY.a.R..].BI.t...R.{./..4D7,.'.{_.......b?z.n.O.k..K.......T<.J....?u...a.f..BU....A...1E.!"..R.AF..M3...*....5m..%.[..;;.....b..........c.<iq....E.;p..Lf.\.5...q...6.^F9"....#F.dI...4...tJ......-.4i. .(9~........PC.B.l...dL^.....0^J_.^.....s.2.l...$..>..\.$e!.9..O.........V..t.[.~:..J~...L..]B0.......K..n..5.}.f6.&...G.u+.|f..2.u..t7.Os..E._......a~.|3T..]..n.~.V-fo..-....8N*......K...3.{..{..n<5C..QEt.....UC...fQ...g.b.J..1..<L.3...'~Z5RW._...

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A100D13B31B3B47B8A440E86B5443E2156994819

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):836652
                                                                                                                                                                                                Entropy (8bit):7.998801040726333
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:24576:RU5+yypiAf3Q5sQ2rveB3Rd0fXj9i+BZqYqrWP:g+yycAY5mrva3RdCjgY/
                                                                                                                                                                                                MD5:A7B1D478B2DF96D28E1707865224FB94
                                                                                                                                                                                                SHA1:119C3E0CC85850102D429A7C68E4C0F6D68D44DC
                                                                                                                                                                                                SHA-256:DAF01B9C313AFEE44D37D2B38C4418BBBA6C23E43EFEF43CA1CF3CA05609874D
                                                                                                                                                                                                SHA-512:5F4E94FD4352E27824A55146A74B4A746DB725EE1A5BAEE502B5573AFEDC392E3D1AF8A03E225BC7F5AE9E289C108DF093D8F3A002DD93B304C166FE652E0779
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:......M.....f..W~)....,........Vs...U...!Vb...6....f...B.B...$h.v.x=..?..D.......;...........o y...*.w.(W#... _../.....u.`...Yq..u.."l.....E........h.M...'..xK.,<.O.....O.h...sy..(BX.[..M...q.......vc.4.L{..9>9..;.......$!..(....0h........s..?Y../Q.'E.,...V....pR...Fr...qs.....Q..T.kz-.........><..:..6r.....$.....(.....--...P.vK..&.d...xuJ6......2j..&oz..+PF<../...o...2=X......2....c.G..V<7.nt....O.!.{m;.}....LP...N|...U...3.).+.SW6G..l..B..u\...m-).9.r..j..nd_....h.*....kD.#.O.0.....;Z........{..4.g..;-+.w.=^..(.m.a/.w$...-....af&..........E~9...8/.....}...3K.2.[b....P.3.k.............N.rR.)..a.3...3./E..t..o..3>.....m.N...o...{..;.........B..~...W....S3..n(..|..Z...Nb.r";.iw.V.6=V..O.>g..k..^.....C=>5+.G..".37..Q.....l~.!...[8.X..+......}r.V._.o...PG.....V.2..._..\.8....e..m......o..&W&..THW.*P4+..........s)....4.....g.A.i........N..?3..{g.i..#.U.}.gL..........n..Gu.a.6.$X....b.n.{.4..9.....;=n..x.d.S:o.+.0.3.?&....V.....J..~.y....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A18266C8C429799AA65E4AB14B71A8EB2CC63F14

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8044
                                                                                                                                                                                                Entropy (8bit):6.041760139287235
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:ZMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEcbLUcpLUcK:VDyuV2Gv+FwEIqSRKcmvwNbZovEb
                                                                                                                                                                                                MD5:4E237D749EC958758D696AF714735665
                                                                                                                                                                                                SHA1:E864FA1A2F98DF8A62BA5086E48C0AA2F8A91A85
                                                                                                                                                                                                SHA-256:797946C930406808ED16A6148900DCBA84A8D3DF9154FAEA1073699D61A7079E
                                                                                                                                                                                                SHA-512:56DBD0FD91D1976E4C706AB596F7E1DB0286ACB97B526582CF73483EFC81B4BC6CFC10A25B71A449553031870F2EB9012762B24526BCA0D94591037A3D7624BA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............e.re.rF.0.e.r...z....a,~1708035654,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/newtab/1/8940dc38-b85f-4355-b090-8e4e300a9627.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB7B7EiQ7uyD

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\A7615E86A1A16BADBC7C7C6F959B650FEEA38F98

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):10690
                                                                                                                                                                                                Entropy (8bit):6.083850315957714
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:haxqSRKcoaxh6+/wPI+eDymtph56TGjyKi3uhfbaI8j3qMVrJYQvqrBrJYQvqr8:oxjQFamXw+8TWK7TaIdYJYQvkVJYQvk8
                                                                                                                                                                                                MD5:A60178651BE4BC3C8E3A2FC7E3B78EEE
                                                                                                                                                                                                SHA1:2A572939AADA993526B416441749A56A46BCC221
                                                                                                                                                                                                SHA-256:EFE0DA36A015A654D2E15AA9BA67378E8C4BE60FD1A61FC361F55B857D190BE7
                                                                                                                                                                                                SHA-512:0DBE7FFD4ECB22297903C6D5F53455CE1638D546F02EF92AD9CC400CBAF7C83F0328F1327FEA1D96A7E71BDCA5AD79E97BD032F4CCBC698C43467E683F144B85
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"page_size":25,"page_count":1,"count":0,"next":null,"previous":null,"results":[]}..J.Lt........e.de.mF./.e.o........a,:https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-search-detection%40mozilla.com%2Cgoogle%40search.mozilla.org%2Camazondotcom%40search.mozilla.org%2Cwikipedia%40search.mozilla.org%2Cbing%40search.mozilla.org%2Cddg%40search.mozilla.org%2Cfirefox-compact-light%40mozilla.org%2Cfirefox-compact-dark%40mozilla.org%2Cfirefox-alpenglow%40mozilla.org&lang=en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAbVMIIG0TCCBLmgAwIBAgIQA47lgwap6xyAEGMLp8nkkTANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIx

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\AA9E7E59450E00B12CB89DC26105523F697A9AF5

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):89
                                                                                                                                                                                                Entropy (8bit):4.639517947791548
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:OXmlh/kEPK6aRePubUZmrRDGRgvKiUll/ln:plh/xy6uhrRD5KiUll/ln
                                                                                                                                                                                                MD5:AB17ED604C1D03A94FA41A9B4EDCB0F0
                                                                                                                                                                                                SHA1:73FEA0C82964C1D7B0CFA2FE9459C99E3F4360F1
                                                                                                                                                                                                SHA-256:D3796E1DEF3E16EE613301C7421DC9909CE6DC8CD7EB93B88C4E8C8F75D21DA3
                                                                                                                                                                                                SHA-512:75BD82AF6F1AF5BD92904EA53ABFBBC9405B27ACA6C5AC7CB9AB0C81EC8D17BB0AD0D2C920A32BE2D63CBDA23E8B46A72B032088307EE3B85A7CCC4F5DB70207
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.PZ.........e.Ae.AF./........0....a,~1708035635,:https://spocs.getpocket.com/spocs.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\AF9D33F865157A3441460C30C5AC5BBD1194A1AE

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):17862
                                                                                                                                                                                                Entropy (8bit):6.523978394592702
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:7V7QlXWp7VqN4mApqN3Xo70tNo+pwPm082nyFz/Lc1:Z8lXWyApQHkKo+pwPo2h
                                                                                                                                                                                                MD5:0035A5A9888865C3997A2B2FBD437EC6
                                                                                                                                                                                                SHA1:2C930E642041BB3FECFC4CF5A004576516FA5211
                                                                                                                                                                                                SHA-256:FED5D990D7F8EC79ED25A01001EA5B4B4E82D7B9E7CA1BFD3AC0A4613F5A4E61
                                                                                                                                                                                                SHA-512:7E467CAC4F94C217AE05B42EE9274CCFD4B5B2F2B2EF37E63666772CDECFB1A19FA4E1546AB7E69E536B319216AB39E80AFB6E02235CFCBEF6446E2D16F70818
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.P.. .-.?...vT.X.!.Az..t...x.ZB.c...W!.\{.:`..I.*y/;.Ba.s.........)`.*..c.....K.".<..W..<.m.{y3{l....6.Y_....o....S.y.7.q'?U......................~..[|..|[.....~..=..V........:..../)w.....oxv.e.t$..T..1v{..........s..DM...FZ5...js....|.9..fW..R.T.s.e..V.....0._h.n..u..eq.s?.|.v....9....$...%.......]..d......D.n....L...`Hs=....y.......R.Q?...2...T..~...A_...m.`... J.......u..y..P.D,KA....5C.4.c............@.......%.4:I.oL.{.6/..-}.....b.V.o.!..v.zS........S.2..bFY.K&F...A!.U"`.(!.D.o....h4...qN...y...H..e..`.....4...<T.O.X.4..s~.1..'S....."h.`....B.\..)^..]3cN|........=...FR....q..b......\..!...q.|.9.q.m.U.l%.b..M.....]......$.j...@Xk.O...^+.G...3.r`...aGf..~[!.p8Y2./.!kZ....+.G.A.......0.....'....._.s..8."D.~.......jIL....T....S.x..5.8.*...}{... ..9?.P9.U ...yw....".......O.@....r.m.[4*y..%...GHl...+j...=.S.`.....U..._.C.....4...Y.R]...S..t..h..i.fW.s..w....'....7.....i.I^.0...W.|m.`....>....MM...w.T.q.!.;.N.........E..<....j{A.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B1A71C5B3FABC7B8A04A7E8395C4770AF56D85C3

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16728
                                                                                                                                                                                                Entropy (8bit):6.280493818271815
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:Z/+u7VqN4mApqN3Xo70tNo+pwPm082nyFz/Lva:Z/+7ApQHkKo+pwPo2B
                                                                                                                                                                                                MD5:501DBFD85C2BF41EE79A375294E1E8CC
                                                                                                                                                                                                SHA1:EE379E63B4C5D228C8734DFE96D5BCB6843D4F8E
                                                                                                                                                                                                SHA-256:925A48A15F315EDEB52F151827C66A6FAE3AE59571380B6067D667FFF02F98D3
                                                                                                                                                                                                SHA-512:171E4351B900622C9528F7B997B4CB268D024A69615C684A8CC8F8F1E65BB394982BD14BF765C4E97B2EA573716E5BDA4BE34816D85D86715DCD4FDC8042431F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.8.. .m...9$L3...g..#EVZl.......?..x"6v..s......@rkD.H.3k.....V.v....J....h5.;..5..8IX...K..G.|Y.C..<...T..iX>........H.....u4...f.? A...._..4.%$}......S&{V.V..BT.....b............xd..P.4.rB k.....z.cR)&.h....O...*GKS......'n..R..D......vv^.O.$.&.m.(.J..3..9.z.n.TP<B8.0M...,..S.y..Xt....=.y.7.=..).9z.c..}Y.....uG,k..n'.G..6y8\|....~.]..uWNy..s!2.r82.V.+.;..=..V/j.....~... ....0..tc-<...<J'..,.'...r....F....{..S.5..w...p..9.,....`.-;...WF.....M1.N.U#}..^K....:<..UY.....wj.kK..2....#>X.B...n$4......MX;..AJ...H...S.#.....c.....El.....S1.A.....?.d9~.M.H...V2..h.!.K...&.....a..7<.e.I..o.y.+.b.....P...Z..1...!B.u-...,...a.%`..B..8...^].av.#.B.v..s..o..0.)G..'$nQ......ln.t2R..,..Q..L.lT.[KHW..=....I..(.u.....OQ...(I.(.T..."%...,i ....n'{f..-5.ww.0.cGmI!..aU.+O."}....}.........G5)WZ?.......i..(Vy....).F.A............C#..........cS.....6+..|....:.\.%...0\cT-....,..,....J....J..#x...|C....=.....b.VX..5.)...P....t=(..,$:m..Z..b`..O..Yz..n..J...

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\B3316860430DA0966649580110E85D2FFB7B5A61

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1116)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):82933
                                                                                                                                                                                                Entropy (8bit):5.671477179266364
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:4GIr9iykWXc8VV4ucbxiyXdpGupDMbSrOLR0QZWtPWDG4nFjI9rkiDyVO9HI4Cka:h45nb3nxQIiENg5Bi+C02byHbJHhYc8F
                                                                                                                                                                                                MD5:DA741A4ABA451747ABED76699DD71D37
                                                                                                                                                                                                SHA1:6A3FE10B1A094A942BB5E324C10D89B9F9CDF187
                                                                                                                                                                                                SHA-256:3F308845D26430A4A8DDF427581B35EE3F26B2EE752C3701758C570B740B8251
                                                                                                                                                                                                SHA-512:AC3F77A1681ECA8E282A3F814B01ACF066BEE0964BE681BAF766D7244293F37689403FC757247155AC7D2CDF3B37ED2E62B9EA92DE4CB04D639F8E16E283CEBE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/*. * See: https://fonts.google.com/license/googlerestricted. */./* cyrillic-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. f

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\BE13857FAF251CCA8C4AE07311778B6623EF86DC

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):18388
                                                                                                                                                                                                Entropy (8bit):5.820352998909228
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:7BPwmZ/4L6dbuMBA62ukuPpioD5OyrudfTaIdaXj:7Ok+M/pvD5OyruJa8Y
                                                                                                                                                                                                MD5:887C8AE66D4BDF527E09F8074A0260CA
                                                                                                                                                                                                SHA1:04FBEB19379A26FF9E8D46F6D1DA0F212BDDA6AC
                                                                                                                                                                                                SHA-256:D46D5826DBE88F2ED5CBFE84C237216C8D24749A87DE3DE3515CBF08328DEFBC
                                                                                                                                                                                                SHA-512:D60666440B2D4542785E4414B1E698CC4601D80A6321D0B519CC6BBB86266D1A996D2BCE6D36378EFBBBD3508FC72101CD46483DEB3455D0C6704237FB57C6DD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"signature":{"ref":"1nrnyu11gemsy3rojpaqyeetdg","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"mfnfF9JHrAmS7XrhpPIgLXGVVcnJmqvq8TuXxBb3s-n8MZonYDBBJKkPFPEYkTX0T_G2mx25HlQ-g_naJlPjU6HEIXwOgybj2uYyoBjVuwbdD8ScIPOc5DO_bCtronW-","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"displayFields":["addon_id"],"id":"pioneer-study-addons-v1","last_modified":1707350416588},"timestamp":1607042143590,"changes":[{"name":"Political and COVID-19 News Information Flows Study","icons":{"32":"https://ion-extension.prod.dataops.mozgcp.net/Princeton-Shield-32px.png","64":"https://ion-extension.prod.dataops.mozgcp.net/Princeton-Shield-32px.png","128":"https://ion-extension.prod.dataops.mozgcp.net/

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\BFB76AE057440A16593FE08B2FE91F5D71B2F963

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8634
                                                                                                                                                                                                Entropy (8bit):6.10425405424639
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:IBRa+nDyVVvpsy4y/GSwTffbaI8j3qWd6+d6a:aa5OyrudfTaIdahn
                                                                                                                                                                                                MD5:2D0BC8AD60359E93E4F0D240CE772774
                                                                                                                                                                                                SHA1:6C8490E54D6FAABFEA44AEA437BACC6FEF8A665E
                                                                                                                                                                                                SHA-256:AE0CDA0AEC31FFA906FBF3730D1DD5F61FA487D4EDAE964DDE2ADF4D87A24A8E
                                                                                                                                                                                                SHA-512:914BF12E33279E8A19CCA15778D32A653B47D5A859A568624246C6B4426C8C792E3E88D09C2FA720A74E9DE672D314C46E94045E50936DF5717F1C2B2DB06490
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"signature":{"ref":"wqbs994h709v3pvqggmsvs7x6","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"d4HeADX-ha3cnpWqMxdnO0ptwfLyMREEfX3sdAruVHNgi4JPbtSz_pATeM7rlnsOg2vN1ssFJc4a8yu9smtBJnRp07sUlTC122zYzkeXw9zbuFuUYmFCSa6lTll_pbEx","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"id":"websites-with-shared-credential-backends","last_modified":1707350410904}}.{...E........e..e..F.0.e..........:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/websites-with-shared-credential-backends?_expected=1659924446436.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgi

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C21C694CB0E5CDDBF3BDF87D7002D98C7EBA39BB

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8054
                                                                                                                                                                                                Entropy (8bit):6.041887463952967
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:OMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEcgLUcCLUcK:ADyuV2Gv+FwEIqSRKcmvwNbZovEL
                                                                                                                                                                                                MD5:59FEAA1E9D71E26C9CEFE924EAE27DDF
                                                                                                                                                                                                SHA1:151F5C6F0F6A8929034F641EE0FCC37E3D55C9DC
                                                                                                                                                                                                SHA-256:82A6188240DA4BEB086F5FEC8C8B6CB24861146D15C9027F0FC298F6B5AAF0DB
                                                                                                                                                                                                SHA-512:CE1749CF14243C5DB84F04497402BA8DEC48539A22FD75DFF51B137675CE69F059CDEAC1A6AAEF870EED8410A764A932120F75AD11AC2F57CF200F3A749096F6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..h........e.te.uF.0.e.u........a,~1708035659,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/ce258073-abaa-4281-aebf-03728e033789.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C886C15B36E63849FB9E86DCC97456303F590459

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                Entropy (8bit):4.903670182881204
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:EVrBEI3PR/l+lljXvX3XDkDKVJ3uDVX8sX3uOX8sXzLWzQ//tsXzISL1cd+XmdVE:urBv35ojXDkw+qsH3X8sXWzgtsDvLKdE
                                                                                                                                                                                                MD5:48CFC1C2A5854007BE1EC5A183816A8C
                                                                                                                                                                                                SHA1:B8266052C175FD728858A76506B54BE06D5225AA
                                                                                                                                                                                                SHA-256:BE712CAD4B275BE942C3512770C480565B5FFB6666E49F7CA52EA26E6EE4BD9F
                                                                                                                                                                                                SHA-512:B1F85451843A5533C775A222E505E4F72DFD54F56E09AFB821BA11DE20E8516C72614908B0E28FA4963B391A15A1A8C437FB7CA80EF0A90CFCDDCCA48D03DA1B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............e.de..F........../....~predictor-origin,:https://accounts.google.com/.predictor::seen.1.predictor::resource-count.1.predictor::https://www.gstatic.com/.1,1,1708035684,4096.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\C8A0038CBF646EF8976D3F18074D209A1EF6AA80

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8583
                                                                                                                                                                                                Entropy (8bit):6.104900125466918
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:0q3Bl+nDyVVvpsy4y/GSwTffbaI8j3qWdWAdWx:Z35OyrudfTaIdaNS
                                                                                                                                                                                                MD5:B569D16290C92E2EABC02F89786CFBF7
                                                                                                                                                                                                SHA1:B649689714126A48DA0A12CB9049744B9A249FE1
                                                                                                                                                                                                SHA-256:72347101544EB719DD4A78E33F838991F78150E2608FE1E16F99AE696EC92797
                                                                                                                                                                                                SHA-512:FD0946FAF705BF5325CBE529335B80B484BAC6AA194FB51AE0F60361A0E36A1E9BC5E0F793D1962A6FCFD72F3CA0DD58D70E2C8DC7B069495E60B52E75934147
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"signature":{"ref":"2cho64rnmpj4p2mr5kgya0mhep","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"1eDeXYmMQCMkhHhxUgPFZxf1DHrJMcsZ_lPaxwFLZX3tQGHbYNdTEnaY_tTbCzSkIc9InPpxU7fY8wB8uayynFUO47he9P7ZS7VKeKQ0Vr_0Vh0p1EjqWKPL8x5pnk2U","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"id":"password-rules","last_modified":1707609608171}}....X.........e.ye.zF.0.e.|...q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/password-rules?_expected=1679600032742.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAXxMIIF7TCCA9Wg

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\CC230D350F313FAE2988A4DBF98AE3240CF50240

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):58857
                                                                                                                                                                                                Entropy (8bit):5.536678951060455
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:PwrmICQbVmOcKxb07ukcVSJd60tM9DaOedtCIBqx5OyruJa8MoB:ZkwOcg07ukcVSJd60sxe2IBq9N8MoB
                                                                                                                                                                                                MD5:F7FCEA01FC389BF1D13EF248E7A4FA8A
                                                                                                                                                                                                SHA1:D6FC6FD3EEB0B8979FAF47809536B0A53184264F
                                                                                                                                                                                                SHA-256:B0288875433ED7179C31F82384020559763E6460001034C5E8C80D92DA99E8D9
                                                                                                                                                                                                SHA-512:882AA4E592771EDC8C0F6CF22B32D2C0CD3B64947039ADF18642C8C0ECAC1682FC499452FA10FFE26B7447DCCAF1AD331AE4C90A580B91D23CAE38A95F42CE97
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"domain","schema":{"type":"object","title":"Cookie Banner Rule","required":["domain"],"properties":{"click":{"type":"object","title":"Click","properties":{"hide":{"type":"string","title":"Hide Selector","description":"Query selector for element to hide while handling cookie banner. Defaults to 'presence' selector."},"optIn":{"type":"string","title":"Opt-in Selector","description":"Query selector for opt-in / accept all button"},"optOut":{"type":"string","title":"Opt-out Selector","description":"Query selector for opt-out / reject all button"},"presence":{"type":"string","title":"Presence Selector","description":"Query selector to detect cookie banner element."}},"description":"Rules for detection of the cookie banner and simulated clicks.","dependencies":{"hide":["presence"],"optIn":["presence"],"optOut":["presence"]}},"domain":{"type":"string","title":"Domain","description":"Domain of the site the rule describes."},"cookies":{"type":"object","title":"Cookies","prop

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\CC921124988E0116C0C37A561EC7489311665191

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8046
                                                                                                                                                                                                Entropy (8bit):6.041463125904164
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:kMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZovEczLUcFLUcK:mDyuV2Gv+FwEIqSRKcmvwNbZovEj
                                                                                                                                                                                                MD5:9E7326E48743BB5E1A26FD9773E89186
                                                                                                                                                                                                SHA1:E51ACB2FD18801ED8152634DE73FFFE071074E3A
                                                                                                                                                                                                SHA-256:295122899BF6651AB391929DB9DAD381D6C6FF2845DC7739916F6F3E30727A35
                                                                                                                                                                                                SHA-512:E10E0C402D52D6B75523FE909C69B215A1C206D11215289429D044130499EEC83AD7CD76750CD5F96E53017A909AA605A3141E95EF32E5908E71524BF18C04BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.X.:........e.se.tF.0.e.t...|....a,~1708035657,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/baseline/1/3d5e2044-5d73-4c87-a4a2-385d595b4387.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB7B7EiQ7u

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\CE2D7B9EAB04D03C2D59B4EA4A375A4A640C2C6D

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):16724
                                                                                                                                                                                                Entropy (8bit):6.277802382156447
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:eXwX7VqN4mApqN3Xo70tNo+pwPm082nyFz/Ltt:eXwsApQHkKo+pwPo28
                                                                                                                                                                                                MD5:8CBCA9E5E4BE7F976123437AD86EECF5
                                                                                                                                                                                                SHA1:83DD4EF5607B33BFB9A7F17911B82ED08717570C
                                                                                                                                                                                                SHA-256:1925E1556E973F38A487E17E831D8FE1FD82E2230A6CDF13E22F7CA080C1E5E4
                                                                                                                                                                                                SHA-512:B0A45F2BB53E03225BC35A6401F03499EB248D2D4A69EC4E6ED51010658FA522805708E57164722FE6B72CC1B494C83C3D10F49C5C662A3125F758CAA25D0B7A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:... .6.V.@>..TZv.8I.....~..$b..IR_y..z.BY?...tr.Q.Ogr..1........l....X.SS.-..61.!...6<...a3...w..[o.]..$$.n.u..ba...G...y}.[.Y.*'..N.v..Z;.i..8.<.FV.x.|.................1.i0.n0.B.<.U..:5U...kbp.{N2...p.]......./.....bLs....cd...7.R.......}.....<1.....[].T..Q...4....ub..._.$...W..D&.............d...+!C8~..$@.x....E.)........e....%r..Oz..#I....,..|Xsc.z'=.|....b..i..5.(..m.8k.t...b.R{.mM.5$=Xx.C...P.k..A.:2..](H...xh......w&..x..c.....5..{gL_QV.._.[.3X.~..E....F...'.F".1.Q......<...6.. ..|[...=..UtO...u..~_....,..Y...1/BI.s..A.....)toF..x..@u.YP.l..."a.|$..RlU..xhG..(.W.r5F...P...B..IXb....e...t...*V.PI.z+.......'..."c#.......Ct.sO.~.@.Qf...e......=....Dj....9.Y.0....*..z...l..$9...9...A....aAw...L...~.0....\.I...T.Vk....8..y]..u...H......%..vZ/n.?..<...<.UP.J......:qP.,..X]......k........G..Rh...W!.B.4....9....M!..i2R.y.-..l...LfEa#........E..V.RQI..x ._1B1..<.~.pr&.$...c*.4r.R.*..i.Mi.1n\..vP.%.......8e.Y..!..r.q.3.y...dk....a./.X.~.X....i......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D059FD0322F695507887307109721C11AAD75FFF

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):113
                                                                                                                                                                                                Entropy (8bit):4.727018466530835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:xUlh/K/llIpu/XNWbdUyGLk8rLtPSKVIDIIt:x8h/alqp2EbdOx0KVst
                                                                                                                                                                                                MD5:88884F6F2E0DA808F2E81589F20A5074
                                                                                                                                                                                                SHA1:BC943274E7E8591454AD8DF9F1A4703454A1AA4F
                                                                                                                                                                                                SHA-256:D8EA4AAE639DF990224D390919EF44FED7894EF4E4D311BDC755F8F83CF95FAF
                                                                                                                                                                                                SHA-512:714D687A3B20B7C2A9D4549B303DD4F9512706B4F3F40E888E1DEE463FE26965CEDE198DEB75E73469ED5FA3FB9A26E63C147F35FFB21AACAAC0A8AF62ED9581
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..7.........e.o....F./........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2710.0-win-x64.zip.....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):35420
                                                                                                                                                                                                Entropy (8bit):5.086410383118263
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:aPtFYceo3KtwnY9nR+eXHxoZ/HJkNTBdHOT5Qhh7veK8t9KZ9:Aeo3KtwnY9nR+eXHcHJk/dHOTij7539
                                                                                                                                                                                                MD5:CDECDA0521012660C7AE09F3BC165951
                                                                                                                                                                                                SHA1:B8F2B2C0229FAFA37D41E9AB90F6082172B5AE55
                                                                                                                                                                                                SHA-256:5DD6CD2203AEE1E642022E270B611247BC73665D85DEE2358A748C62740B550D
                                                                                                                                                                                                SHA-512:2F2E046353F16D101686ED283DA865DB148A664609AFED5205AAE844817EA061F461EA5132E38630D1E085616ABA6727318440C55FF9E600180DA476BEB5E2B3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Thu, 15 Feb 2024 22:21:13 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D42241CD73F06B06A985F8853ECB69AD2698C5B0

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20118
                                                                                                                                                                                                Entropy (8bit):5.823173395841894
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:SKB/eAtKgTlK/7pXuKOycJEDvaRuLQr+BKHMpmW3m351GOZl64Chsig8OKXddlHa:NPebbAxv7EswJ5OyrudfTaIdaN4Nf
                                                                                                                                                                                                MD5:C8CEBDB33378E2FD6D8E370BB7768051
                                                                                                                                                                                                SHA1:4203430EBE1D6072F5AC50CCA497ED8917F6ABFB
                                                                                                                                                                                                SHA-256:D03A9758D4F97F1B5836BDB106A0AAEAC5BCD5829E0AA3281790387C5198BF43
                                                                                                                                                                                                SHA-512:717C8BAE3EDD0F71ED71A2135F65A00ECA81068EF5E28BE329150237CB54DDB490AEBEC8E7E08166F39F92571CA3C5FAD440996AF3DFFECC59FBBEF3C74864E9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"schema":{"type":"object","properties":{"id":{"type":"string","title":"Id","description":"A string that will be used to identify a browser (e.g. chrome, firefox_android, \u2026), not tied to a specific name"},"name":{"type":"string","title":"Name","description":"The name of the browser (e.g. Chrome, Firefox for Android, \u2026)"},"status":{"type":"string","title":"Status","description":"Extra information on the version (e.g. current, nightly, esr, \u2026)"},"version":{"type":"string","title":"Version","description":"The version of the browser (e.g. 99, 15.1, \u2026)"}}},"signature":{"ref":"wg4ervidtfus3orkrx2xnnycm","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"WO3QsVoR5EAIn8OFn3QQ4dZ-IBlCIXYJtpQgGZ-SmxIlwrRnGByRz0tEeF8en9Qv99NLr6ww5qG1bZShN6x5GJjbDHqygPwldQiuOctVeTgMIvEew9VKe5B2vELihZg7","signer_id":"remote-settings","public_key

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\D571BBAF93D98B1EFDFC94A791C6232B2468BBE5

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):79402
                                                                                                                                                                                                Entropy (8bit):5.395584019485506
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:wwNUVzjw3BMZSJehg8EsLDkMnCszSYRK6vcmB5OyruJa8Q:VUVzjw3BMZSt8VcMn7VTvLNN8Q
                                                                                                                                                                                                MD5:26A1BF40AF24FF9DE944C7257816F429
                                                                                                                                                                                                SHA1:722E94A4EB11A41F17D4B838BCC9020F2A2A0C0A
                                                                                                                                                                                                SHA-256:1CBC7C07E5D5DA138B7FE0C0D4AC5F03F2D4B59CB9090B90C4D5F5F1BC4210A5
                                                                                                                                                                                                SHA-512:F6E2E4E298C5FB830C746DB5325F0E78F420F9E1D7F69CB596C62CB2C1B8A3AD93467829957B4A2F9214FFCF3C96725B3DEB87F384F484F3C081CE08739D14CD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"-last_modified","schema":{"type":"object","required":["name","version","fromLang","toLang","fileType"],"properties":{"id":{"type":"string"},"name":{"type":"string","title":"Name","description":"The name of the language model"},"toLang":{"type":"string","title":"To Language","description":"The BCP 47 language tag that will be translated to"},"version":{"type":"number","title":"Version","description":"The version of the model"},"fileType":{"enum":["model","lex","vocab","qualityModel","srcvocab","trgvocab"]},"fromLang":{"type":"string","title":"From Language","description":"The BCP 47 language tag that will be translated from"}}},"signature":{"ref":"2xxmu694pbs0b2koipryi3nfks","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"A_g5jkBYqCHbTCgARYus-oUOEFc3-72qoXFYfhOPlOxkJfkuesyHTdJmILeBQZj18n6ZyX8xyxpiwOAa0gmHcjOyk48_gYLUnTXHjGkI

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\DCC7FB835C6936E595F9B4F680D5035B83C92405

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:PEM certificate
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12946
                                                                                                                                                                                                Entropy (8bit):6.0388781338849356
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:HKgNu9fiGLm4pUocjQ/fTpcjQ/fTgtLets:qPBi8mCUocjurpcjurgb
                                                                                                                                                                                                MD5:F8E01CD1D1F91E9C3F3ED72A590E4AD4
                                                                                                                                                                                                SHA1:DA0F05B807C43E1720E79DDFB5DC14E2431DAD3A
                                                                                                                                                                                                SHA-256:E00066747EC23E6FCCF61028AA3C0E86177A2CC1BA105F32A3AC0C14356D6D60
                                                                                                                                                                                                SHA-512:F747512F456D33C02BB63835181FD8DB1F3DDDAA95A1B867E7F8C9AD77B4B61321390DEA07DC15D4D6F67DE44D9D158C1745DDC777B43C4216CD104548B1558A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:-----BEGIN CERTIFICATE-----.MIIC6jCCAnGgAwIBAgIIF68YDD18VdEwCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIzMTIzMTEwMDcwNFoXDTI0MDMyMDEwMDcwNFowgZ0xCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczEqMCgGA1UEAxMhYXVzLmNvbnRlbnQtc2lnbmF0dXJlLm1v.emlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEl+UshrMPfValtEYuWsIn.10tuvFfI1VUswHTj0imzaDtt5frn5eMI7TPGZUlGUgxGmanrdSQLPG2gF+2/4uCw.sUs3EefVlGnbXDdIes+EaM3DL34n0XFqw84zZhl9Igbbo3YwdDAOBgNVHQ8BAf8E.BAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAUoB1KF0+Mwis1.RfFj8dpwcKfO+OEwLAYDVR0RBCUwI4IhYXVzLmNvbnRlbnQtc2lnbmF0dXJlLm1v.emlsbGEub3JnMAoGCCqGSM49BAMDA2cAMGQCMArFg7s5d0k871iARaQP6Ek4otNy.O78D5I0dNxHNIQ/RLC4TZxqhoszxwbPJXTbGwAIwUU3fJVKZecxUGWWZUpawoE

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E2E2DB2F02258A8F9FEF833AA106B9511B475D18

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8715
                                                                                                                                                                                                Entropy (8bit):6.106499905739571
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:zBm+nDyVVvpsy4y/GSwTffbaI8j3qWd+dh:A5OyrudfTaIdaih
                                                                                                                                                                                                MD5:DDEDEEE4123227076014F83B55902789
                                                                                                                                                                                                SHA1:C266B9D07DDFDCD8254DBB54C868A53F0530C886
                                                                                                                                                                                                SHA-256:C357535FB0E57C487EF815EA946481BC9CE7DCD9375EB347E346A25F67CA4560
                                                                                                                                                                                                SHA-512:AF87226FB7FD50567DA020081D81BFFE03E0D74F914EB0D75C47D81EFA8449A3307303BDDF8473AF0D57E07DE64E3B5AD719AEA47A9DC93CF562D954A956E5A4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"permissions":{},"data":{"signature":{"ref":"34nta6vex6w6z8lzthg9s22p8","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"8bWDJHY3BjqzikTDc26pXbXrChoOcVEIF50UOJPU9xBeoQnYUXe5BwUWTy8RqzfG3raUHBiWSAvza2yfyzbliXaBAdt2_tK8xOqmJaHg0-vYemETbE2KS_r76wQgLqNR","signer_id":"remote-settings","public_key":"MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9/8sqFZ+dU3XKZO6K+T1Ez9wiWI18wv2atOP1JBioLK9RDzM+2lP3hcnmkdKPoF54BBcrrUruEYcLg7gsw2EWoqGzqOXmUVf5aDVfUHQxV8aW4x3H/oT0qGFXgDFHb+t"},"attachment":{"enabled":false,"required":false},"displayFields":["thirdPartyId","overridesId"],"id":"search-default-override-allowlist","last_modified":1707350421010}}..i.Un........e..e..F.0.e..........:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-default-override-allowlist?_expected=1595254618540.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAA

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E8D08DAD0FB6E27145709A42880F6C81F3BE873A

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12054
                                                                                                                                                                                                Entropy (8bit):6.025115926006279
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:YKCJy5JIJ6stIKgB9JseJ9ZJ9eJHlJ9OJy9c+nDyVVvpsy4y/GSwTffbaI8j3qWK:YKCe6IH95+Tuac5OyrudfTaIdaWR
                                                                                                                                                                                                MD5:57EE74693C28D7297B8ED4F1AAA504CD
                                                                                                                                                                                                SHA1:1F2A4D39A8E275FB680D58E422FE5D3F06A8BF1B
                                                                                                                                                                                                SHA-256:5F4285CED060244F788F097EFBA690A454173EDFCF5A3DA0CFEEDFDB7563A9DC
                                                                                                                                                                                                SHA-512:7B13876E91C9F86A7DABA21BD2FA4EB09FA38CA94FB9C7CAEBAE8B5510B760BE296413C6B6447673D64E8ED230AA69ABBC65C29BB00213C5E94719EF6683AF2D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"-last_modified","schema":{"$id":"http://example.com/example.json","type":"object","title":"The root schema","$schema":"http://json-schema.org/draft-07/schema","default":{},"examples":[{"id":"US","providers":"cloudflare-global, nextdns-global","rolloutEnabled":true,"steeringEnabled":true,"steeringProviders":"comcast-US","autoDefaultEnabled":false,"autoDefaultProviders":""}],"required":["id","rolloutEnabled","steeringEnabled","autoDefaultEnabled"],"properties":{"id":{"$id":"#/properties/id","type":"string","title":"Region ID","default":"","examples":["US"],"description":"An identifier for the region compatible with Region.jsm"},"providers":{"$id":"#/properties/providers","type":"string","title":"Regional providers","default":"","examples":["foo, bar"],"description":"Comma-separated list of provider identifiers, referencing doh-providers collection"},"rolloutEnabled":{"$id":"#/properties/rolloutEnabled","type":"boolean","title":"Enable rollout in this region","default

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\E95776CD806CC5C4C2D97C796969D6166916C2A6

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8044
                                                                                                                                                                                                Entropy (8bit):6.040583040517536
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:XWMgDyugQX2GoC+FwcGsVQgyqSRKclIv35bMbm5uZGebZov0cZLUcHLUcK:XYDyuV2Gv+FwEIqSRKcmvwNbZov0z
                                                                                                                                                                                                MD5:8F5DB9A868465264C55A34C65B79A292
                                                                                                                                                                                                SHA1:0BDF3D5D3E12CB91949850D883DBF66695301ADA
                                                                                                                                                                                                SHA-256:39CBD457FC4B970EE3A21D91CD58541BB27B9438C6C2F587E72756F6D0654A55
                                                                                                                                                                                                SHA-512:0BE957FFF8ABD96AEA43C650F91C56FAD0D9F74F0626F0C52A6F9B97EA104E699B4C7189B107336417B30270550F551927ABC3510AFAC1C9600A310955E6B82F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:a. .........e.de.mF./.e.m...z....a,~1708035637,:https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/9a79d70f-85b2-4e0d-986e-5df43330e7f9.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX1MIIF8TCCA9mgAwIBAgIQAeBji5rfnEKbkKRvWJHfVzANBgkqhkiG9w0BAQsFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xKjAoBgNVBAoMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDEqMCgGA1UEAwwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMB4XDTI0MDIxNDIyMjEyNVoXDTI1MDIxMzIyMjEyNVowgYExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMScwJQYDVQQDEx5pbmNvbWluZy50ZWxlbWV0cnkubW96aWxsYS5vcmcwggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQDak7pCzfznaimVmew0DsoGxvuQF2PHroRxS9/EHqBjQn/eogpbDNF+vuXHsbVCU/qGCe43Q2rhi5FDTjmmQc0cfZyNQ3/jbPfOsQgegwHm6AstdL/t9hipBZZC8q4sjbB7B7EiQ7uyD

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F70837499B890A8D3B5C5907DA600AE3DEF49903

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9758
                                                                                                                                                                                                Entropy (8bit):6.111130632436094
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:d+nBNPcuxFRUf+nDyVVvpsy4y/GSwTffbaI8j3qWd8db:dGQ5OyrudfTaIdaMb
                                                                                                                                                                                                MD5:A817EA3AC0A1E6699905ED3D43C4E196
                                                                                                                                                                                                SHA1:2826F4E007EFB19486391624CDEED1D0DF186086
                                                                                                                                                                                                SHA-256:1C41B291E08121E0799E58EC96F75907DF0455C8916F6ABBB6C20C1CC01DF1A1
                                                                                                                                                                                                SHA-512:B299658568887C7BFE25D51F00BF1AB8F0AD6C3550F9C9900389E9FD42605A4FE61C157B6C4B401B15696DE81CEB914D11E3435ABDBCDACF79100B86CB5FDEA0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"metadata":{"sort":"-last_modified","schema":{"type":"object","required":["name","release","revision","license"],"properties":{"id":{"type":"string"},"name":{"type":"string","title":"Name","description":"The name of the project, e.g. bergamot-translator"},"license":{"type":"string","title":"License","description":"The license of the wasm, as a https://spdx.org/licenses/"},"release":{"type":"string","title":"Release","description":"The human readable identifier for the release. e.g. v0.4.4"},"revision":{"type":"string","title":"Revision","description":"The commit hash for the project that generated the wasm."}}},"signature":{"ref":"eaoeibnudz7bphejpgkqy74j","x5u":"https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-03-20-10-07-03.chain","mode":"p384ecdsa","type":"contentsignaturepki","signature":"HmgBRSTwmsTm_SRwLUonxeTy1baYvNN9e6HIy06LmXrtWA7MW8VXRT2aVdTu2jsypdpSEBoVvtGH3EIeT0Rbxiwtps43fC5phNlJFfCTKbAFB4GRvwSL8D8DZDRb2M6p","signer_id":

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):8559
                                                                                                                                                                                                Entropy (8bit):6.093555663397825
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:QruN+nDyVVvpsy4y/GSwTffbaI8j3qWdvdG:QruN5OyrudfTaIdaFG
                                                                                                                                                                                                MD5:F28E4B4545AEC268EECF78AB05A4841C
                                                                                                                                                                                                SHA1:718F257F75628F3E130D2941F5F1B54B3D14CC65
                                                                                                                                                                                                SHA-256:65B15D0A85852A677C70B3FD47AB3C4B34115FB72DBE93F4DD207A47D6189BA2
                                                                                                                                                                                                SHA-512:15E7E9C7B5CCC532ED295ACE4C33896E6FDEE5C6768E3DE63D57D4FBBBAD1CBEB5A4E36336A35F46295817B5C60488D033DAAFFE9F2579EECFC0636630A9E335
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"project_name":"Remote Settings PROD","project_version":"18.0.0","http_api_version":"1.22","project_docs":"https://remote-settings.readthedocs.io","url":"https://firefox.settings.services.mozilla.com/v1/","settings":{"readonly":true,"explicit_permissions":false,"batch_max_requests":25},"capabilities":{"changes":{"description":"Track modifications of records in Kinto and store the collection timestamps into a specific bucket and collection.","url":"http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes","version":"32.0.3","collections":["/buckets/blocklists","/buckets/blocklists-preview","/buckets/main","/buckets/main-preview","/buckets/security-state","/buckets/security-state-preview"]},"attachments":{"description":"Add file attachments to records","url":"https://github.com/Kinto/kinto-attachment/","version":"6.4.0","base_url":"https://firefox-settings-attachments.cdn.mozilla.net/"}}}.-..C#............e.pF./.e.[...2....:https://firefox.settin

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\entries\FE1F5B94E735CF25E43C634E82ECB06C772BE012

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):7044
                                                                                                                                                                                                Entropy (8bit):6.033340909043278
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:Ly/DXVtIuCFzy/DXVtIuCFM8jjt8+RZFPPqa:LyD+FzyD+FrtLsa
                                                                                                                                                                                                MD5:05992ECDA72F160A2B6B2B206AC50ED1
                                                                                                                                                                                                SHA1:1F4FD974389AAFC5F75B4D817496CF2CB7B2E333
                                                                                                                                                                                                SHA-256:00706CFA277CAA07230FC9F6ED2174969C947EFFAF643FACEAF25ACD6573E6C5
                                                                                                                                                                                                SHA-512:D40E3E6AD586BFD8242793E588A71DA6F03C3D48A78A3C6DC4B8A6BBF299D3BCFBA9366EF5FEA53878828936FBCC8A0ADE124CCE1E06F7FFBCD1C1C3C0BCFC85
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:nF1.........e..e..F.0.e.....J....O^partitionKey=%28https%2Cyoutube.com%29,:https://i.ytimg.com/generate_204.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAW9MIIFuTCCA6GgAwIBAgIRAJEGaeSZHqW6EGgobbNDtFYwDQYJKoZIhvcNAQELBQAwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDAeFw0yNDAyMTQyMjIwMjRaFw0yNTAyMTMyMjIwMjRaMBkxFzAVBgNVBAMTDmVkZ2VzdGF0aWMuY29tMIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEA2pO6Qs3852oplZnsNA7KBsb7kBdjx66EcUvfxB6gY0J/3qIKWwzRfr7lx7G1QlP6hgnuN0Nq4YuRQ045pkHNHH2cjUN/42z3zrEIHoMB5ugLLXS/7fYYqQWWQvKuLI2wewexIkO7sg7/dceKEUfCvU2M8916kDC1H4n3ml4TYEyRMuWUDPLto9jKWhH6FRwO+sU3V1yC534tvpx82bmv5eklX+FezkgvrFC2HBuW/Cw5EYYZ3O4ZGSi7yQy9TU5MK4nPMZaSlXJHKtg0FW7NiRxtypA4HdJSSVSLcC0huLHWPbdkjn

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.metadata

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):67
                                                                                                                                                                                                Entropy (8bit):5.465124078420598
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:219+OdrvjytirXjeQIl:2+wvYyXjgl
                                                                                                                                                                                                MD5:E28850526946A48A8D95E92576161E02
                                                                                                                                                                                                SHA1:CB4504322338098237DC38E0784AC4C365A7F05B
                                                                                                                                                                                                SHA-256:D4CBECD7B1BDDB66A3F1D252D33BBF00A08E8CD421EEEF6EA157177B5A6361EB
                                                                                                                                                                                                SHA-512:8A99F222553246066E56726D4005D391DA9DD2DA2E6480ADE9DCD3E7342AB06BEC4F623D92009D98AB5BC984F58DB37506D2934D8B99298B8ED5EDA478AC279E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............".0010...........B ....=.1.....3x....7...|H.........

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.vlpset

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):582842
                                                                                                                                                                                                Entropy (8bit):7.701929583838612
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:d14q1lTiqZsU5pEDx4tVy1OBA7aWAtXzknNWFq+/W5MO7ZB:dmElT5ZHeDxPgBeaptXz0s8+/W5Td
                                                                                                                                                                                                MD5:813E792B484389418989E3F88ECBBFA3
                                                                                                                                                                                                SHA1:B3FC01A6AE5F8E316D2BFCA46E6A2E39E5A49AF1
                                                                                                                                                                                                SHA-256:1D27C0FA3EDEB147171D59FD7A725F504451582426E84E2C2FAF19409889A457
                                                                                                                                                                                                SHA-512:700ED883969E6588EFA5722BF8C7EC3656D84EB3ABA9EE13FC6EE6333E4888C5287275966FB65661B74D91C85817580F7ACE126358687A04D739E4FBE9D410EE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....5J.6........W....'..eM............ ..B+.......:...<.o.S.Xza.ICz. ..Ng........+...M%...f..p......../......t.....>...J.\\N.&"T.\.l...z.Z.}.<[~.....<......=...T.........@..K....~..(...z....2..T.'.>.@..TC...F.~Ta.y#l............+...`...|..p...6...........I.......~.....$.-Z&.H.7.l.G..J..'f..nj..{u.........W......a....>..&...@q............%...2...<.L.F..1I...]..._...j.Ymq......}..ho...x.....5...2~.......B...G......f...,1..[.......c....n......w]+.g.4.dQM.g,e...h.$.j..=t.@+..nh..e........j...S..u...t..]....{......,...s...i........@..3./...1.C.:.F.C.V.W...a...h.H.i.j.v..X|....P..........8.......3........@..Rr....&..{0...?...A..>G..P.W+S...Z..f...h...l.u0z.....>l......j*..6J...7..v....4..%....S...P..............{.......`.2..>;.t*L..`N.c.Q.H.l.Q.......A......z.......\..g...........&........&...+...7..r@.0 R.ug_...e.K!u.*...K=......."......a...+X...p..[u..1....I..x....#..x.#...?.}.\.#.c.PVp.2..%....u......R8.............u?......d....4..Jr..R....u..|...KM"..&...).Vn0.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-downloadwhite-proto.metadata

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):65
                                                                                                                                                                                                Entropy (8bit):5.471991851323575
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:2oe1BkHmV+OQjDz2rLmhmk9bqKvn:GoGczD+QmZKvn
                                                                                                                                                                                                MD5:96903A6528D97E36EE7B4DD64ADA5E33
                                                                                                                                                                                                SHA1:11A3D98F17AAF65061DD1C8D4DC22186D71CB4ED
                                                                                                                                                                                                SHA-256:1054D8C88F5EC10A595D4D9E9004085A4768A3902668D4AC4AC1B676BFEB1DC3
                                                                                                                                                                                                SHA-512:6B95579B445F83EC3296E3F059FA2DA15017C180BFDE96D2EAB2C109868C1AB229AC43BBEF8493AD8315EA8E690D7F55EF41CF7719B6A08B9CC5DC3468E55F14
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............".0010..#...._.T .....bm..nC.{PL.........^..}[...9.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-downloadwhite-proto.vlpset

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):37349
                                                                                                                                                                                                Entropy (8bit):7.995016769808263
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:768:wz0fu1txSrQIXZ4cWSDNjvMflwbnmVDMaKYHXeHL/h/:wQfuTEp4XIzuAg3e1
                                                                                                                                                                                                MD5:CF3989ADA19750F5BBD46BC8ADAFFB7A
                                                                                                                                                                                                SHA1:0708F2ECB06362EAAC117090E4C8BE323922EF03
                                                                                                                                                                                                SHA-256:C9C80D8B5B9464FD22E1C8B84BB80792FCFE69FA56F52F7B491E7FCB6DA6C8F4
                                                                                                                                                                                                SHA-512:90E9D108A2A645DC1B97A26C225695C1DB7572E94F88E952E122B44731BA5CC59882EE97F3F2E0489ADA295942212F13436ACA56612A6FE5FAF5284FB3AE02FE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....5J.6.................... ........Nt.*HO5..*... ..UM..7<.............~.'.....V.W..;B.........R..Cl.&/ZM....L...n..9.k.7<..ST....Fv.^}@/3w1@..U...wWG.(.....V....(' .J...w....&1.D......n.&|.J=.......=...`H.l..G......... ..R..P.wS6.....\.D.<.....2..zH.dL...i.W..2.......%...2p..j<q......I..M..H*.O_.i...p....B..)..m..Oty}...`.f.l.4.^...%i..d.lZ.$<R.W...J......j.....a..g ,G".1...~.>.x.....7....J..@!t=..b..Q....;..l%8|.n.......2z.%..;..3J.;..S...VV..[.........%,....Yw...{`X..,._........,..V}v%G....D.B...)O....m_.....J...`.6..._B]..;....?.$@v....9.fd.ee.O.O.e..L..5[..?....?..y.%..g....~8.B..p!.$.U..Af..F...mu...(....D..!0].A..l59,.........90.....(.E].\z......Y....aa...T...QI{(....R.<....u...b.cQ.iJ].....mh.u@..G..D.|FLz./d=...U.K.p.}.9.U|Ib...(n.y._..9.d....OC.....b..C.A|.8...\,..s....L.`f.....e....g....C^2.....:...V.../J....c..fPB&.t.....4.T.aq...!L..u..A.....Q..BwWi..Xd..`+..'....z_.[.......,....b.z9.[......O&.1%.7r..=}.*....c.5.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-malware-proto.metadata

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):67
                                                                                                                                                                                                Entropy (8bit):5.453857100776368
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:w19+OIB5w8BjWcOT3Q2Sn:w+noZcOTun
                                                                                                                                                                                                MD5:E09BA202EFE9C42A5417D44698A82FAB
                                                                                                                                                                                                SHA1:B3558E945EACD1EE3D47E5974F9F768528ED5D17
                                                                                                                                                                                                SHA-256:0E9835BBDFDC510E2753027796C554AE928637B40E1846C59402BB880FF0200B
                                                                                                                                                                                                SHA-512:47CBAA2FE4DED3F70010E4F698DA7C9C7BFA42057073FA47463109971445187F69A3040F781493994B77EDF661CE546872940C53A85216D8384890846C1E0CDF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............".0010..........M.. .....NA.........g\..U6.p..*...E..

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-malware-proto.vlpset

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):229736
                                                                                                                                                                                                Entropy (8bit):7.999185666091358
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:6144:QsONA1rdWNb4+VYCWtZU16SphftsxGRLQevF8IzzWoE:W5bflWM60hft0GSevFar
                                                                                                                                                                                                MD5:E393E976495DF3A82ECD855DE18291AB
                                                                                                                                                                                                SHA1:898979C44C04221BA435BD8384F172CBF67AD1DA
                                                                                                                                                                                                SHA-256:EB9D6C61614DC6F7DBF609A7E4448981F45ECD57016A2AF4F288B5328FA3341B
                                                                                                                                                                                                SHA-512:06DDD403AD7A63BAA0D0C429FF683FC1E658E77AD81F8867D6AC9043CF295202EFCB1552CAE17C0E5962EECFCEB97F686C38CF5EE1180ABBCDEDD1227779594D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....5J.6....R..................\...P........2...<..p............<...b..)...MT............./............-..n.......@...........a.....".Z9$.$1%...'..{'...'..d(..(.o*)...*..4/...0...2.*.2.[.2..C3...3.n07...7...:...;.V.<..9=..>.1.>.. ?.8p@.x.A..A...A...B.&.B.. C.7.D...D..vG.k.G..DH..H.K.J...K..xK.J.L...N...P..hP...Q.n.R.z.S..:T..T.U.V.6.X.Q.Y...Z..[.a.[...\.w.\..R^.)Y^.3.^...b...c.C.e..:f...f.c.g...i...i...i...j.%9j.O.j.R.r.n.s..+t...t.,.u...u..%x..6}.BQ}...~.....0^..(r...*.......P+..hj...L...A..(....'...L.......... ..n......5...,...K+.....c...7a...g.....g...v..\.............(K.....X...).........AT..Ho...3../..%..D...rS...&......7.. ......O,..J=.......6......4....}.....\...N...@...Q....@..K....#...m...o..........bp.......&...............,.......K...W.......u..<...'....0..f.......I(...b..G........$...y..H..........\S...Y..-|................q...{>...Y..er....../L...U.......e.......n..g...n....J...\...1.....wv.......9...g..p...u....E...........+...........8......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-phish-proto.metadata

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):67
                                                                                                                                                                                                Entropy (8bit):5.536092548602143
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:01j5+OJviFud1kxrDIn:0+1ubQsn
                                                                                                                                                                                                MD5:DFA290549AC7A391649468810C9543A7
                                                                                                                                                                                                SHA1:8752270B24A1BDB2846E4DC58650E1A920B633FE
                                                                                                                                                                                                SHA-256:A9D2CB30E0940B000EE7B32A33927813390D674B9B4F2B822A06B28C54515E9A
                                                                                                                                                                                                SHA-512:36F853821AF5C153A95C6C3EA7D32448E5AB707A0EC69AD1B7F73EF30631B275266526B40C3AB5BFD3D1A75832EE834232EAB37C07CD267AC93ACC44456D9667
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............".0010............. ...xI.<.$.x0...Q...n.N...X..#.#.}C.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-phish-proto.vlpset

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12636106
                                                                                                                                                                                                Entropy (8bit):6.302293769492921
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:98304:gm3wph0JPI33D+FFj8N9qbAm6KFklmBcOdcNhw4XlGnw1fS3r+rAhrkwCuueC:g6wmIHKsNm6ZmuOyHronaug0u
                                                                                                                                                                                                MD5:DF716A8C8BADD87F77BD9CA4AB29C45E
                                                                                                                                                                                                SHA1:F26F802D052508BDA568FE31123EE32C8270A69B
                                                                                                                                                                                                SHA-256:BB9F38942A34A2072F5842DE932045E3CA18EE3EE0956C6396EF932A2014C0E4
                                                                                                                                                                                                SHA-512:850B5FFE23BEDBB908A151D97B1BDAF066E9F8C4167C812E4B0F594F1F57B08E6C64D7DFA0F1914E60E88FDD7D533F30FD9EDD93FA9B0663139E9BE2C14A61E1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....5J.6..........[......x......8....C..,}..,...J...&_......J....P.....................N....P......L....G..^...=.... ...G ...!...".. $.H`%...&.#.'.`\)...*.!.+..2-.h...P.0..d1..2...3.4.5...6..7.I.8..1:.\u;.Z.<.R.>.uh?...@..SB...C...D.} F...G...H...J..[K.'uL.=.M...N..-P.|.Q.D.S..IT...U...V.=IX...Y..Z...\.yg]...^..._.w.a..Zb.u.c...e..\f.).g.s.h...i..]k...l.T.m.]=o.\.p.V.q.e.r..Ct.6.u../w...x.e.z..({..J|.A.}..,......=...<..Iv......$...........#z..8..n:...x............ ...T.......tM.....*...o......5...v........+b...f........|...7..3}.........=..v.......?...............i..........[.._...B...........5......Q....%...s......M....c..Q...%7..X{......x...rG..........#....O.......D..s........,...R...{.........i....y..o.......0........Z...|.......f.......+...n..P....5...^......H....e..P...............M.../G......5...=...^^......t)..'...C....C..n...-........r......+...,o........-.!..V".R.#.c8%...&.0.'..S).V.*.O.+..+-.w...F./...1.K.2.4.3..V5...6.# 8.Bh9...:...<..:=..T>...?.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-unwanted-proto.metadata

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):67
                                                                                                                                                                                                Entropy (8bit):5.4054225858832865
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:y1BkHi+O6TzoDYF+7Y6uqq:yoTNwd7K
                                                                                                                                                                                                MD5:37247ECDFCB43A62BF1127C2685A4164
                                                                                                                                                                                                SHA1:691A4AAF55BCDC98C79E80331DCF11384F645750
                                                                                                                                                                                                SHA-256:E08B2352D81CC9002BF516953A23F29DA03688C850977A1AD81F63B1B9F24FDC
                                                                                                                                                                                                SHA-512:E39404B36D4E02C3FB89BFDFC5E9E3B7664A069B3E3473ABC2317920AAA33718B3C04B2A9475399C381F20F21C1EF5BCFA48FC3065B49ED1BDA62592B9ABA839
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:............".0010.........Ql.. ....zx..Q.kI.....x`!.sq1......]B.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\safebrowsing-updating\google4\goog-unwanted-proto.vlpset

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):126596
                                                                                                                                                                                                Entropy (8bit):7.998596393015095
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:3072:Xbh866o7fuWe3MYfMgNxZ26j/widttyRZ/hg:18eTuWedfMgtwidttyRZpg
                                                                                                                                                                                                MD5:AEA7F04C4CD6BB537FDC0ED526A8D063
                                                                                                                                                                                                SHA1:9D70D63675A2C8AB91369037FA75A58AFE71C9B6
                                                                                                                                                                                                SHA-256:C93A94518C77EF4422F8AFF870F658ACF0E582E7B7ED9F2CA68677FA22D3F6C3
                                                                                                                                                                                                SHA-512:957689511FDAA91695239CFBFB8FB28300DFB5E7485CA38216D9CFB0E42CE4C38613DBA2B0DCC273D2DE7CF5E2A81A749E5989C2AE755CC705D9A475A8CB0138
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....5J.6.....{.......'...F..o....5..)^..M....o.............G..........M........5..Sx .S.#..\$.6S%...*...+..d-..h/..k3...3...3.l,6...6.#\A..%G..0G..qJ...O...P..QQ.s.Q...Q...W.p.Y.s[Z...]...c..f.sdi...j..k...p..Qq..Sq..|x...z.W.z.WE|......0...E......Y......e......%...9......5............g.......g$...........^..0......7;.....4........z..0_.............w-..V....*......UO...m.......*..*.......P...............#r...............L...c..Wd......6....*..#.......aI......r....}...$.._\...\..Ya....... ..L..................2....E ..R!. l!..M$.."*...*.j6+...,.Dh-.1.3...9..w:...:.w.:...;..q?...A..MC.._C...C.&NE.Z[H.%.N..>O...R...S..T...V..nY...Z.C.[...]...^...`...b...c...d..(d.+.d.d.e.H]e..Ag.^.g.I.k.._k.E.n...s..8u..u.(.w..?x...|..0.......f......F.......3...V..................G.....Y....(........@..%...$...f.......w..........c..~...;j..8....~..GQ...s...M..............X....../y..............2...A...u:.......C...G...^..................&w.......|..I.../=..........;...=w.........

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache-child-new.bin

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2029892
                                                                                                                                                                                                Entropy (8bit):4.701156726468159
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:+6j+d487l/bpQoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ib+M5TkRYX:AdR7l/bLs6BjUNRYRck
                                                                                                                                                                                                MD5:04F00B709D92A4DC8BF6CDDE6AC3BFAF
                                                                                                                                                                                                SHA1:E8F46721CB9E33A40C55CFA52B08371722FEAA63
                                                                                                                                                                                                SHA-256:62E09ED0E9A8136BF7FDD439BE0CC326C5FD84AA511CCE50C0D4DBB68BA37E06
                                                                                                                                                                                                SHA-512:9DE3CF0A0C752AA529A7F38E2B7FB2070B502925D9017C103C32BD117089F347E20996E2FB3B118EB1219746AACB3F4ACB66FB187B44937331EF3D881F75BB69
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozXDRcachev003......I..9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache-child.bin (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2029892
                                                                                                                                                                                                Entropy (8bit):4.701156726468159
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:+6j+d487l/bpQoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ib+M5TkRYX:AdR7l/bLs6BjUNRYRck
                                                                                                                                                                                                MD5:04F00B709D92A4DC8BF6CDDE6AC3BFAF
                                                                                                                                                                                                SHA1:E8F46721CB9E33A40C55CFA52B08371722FEAA63
                                                                                                                                                                                                SHA-256:62E09ED0E9A8136BF7FDD439BE0CC326C5FD84AA511CCE50C0D4DBB68BA37E06
                                                                                                                                                                                                SHA-512:9DE3CF0A0C752AA529A7F38E2B7FB2070B502925D9017C103C32BD117089F347E20996E2FB3B118EB1219746AACB3F4ACB66FB187B44937331EF3D881F75BB69
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozXDRcachev003......I..9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache-new.bin

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9050156
                                                                                                                                                                                                Entropy (8bit):4.734875299814785
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:uwTv3Dxd4CqeWDc+ikpXGBmgKDkG0C6RAuAgdyR+FBG1Kl/S/qyafN7h//uTl+EL:zv8cW5IBmcAVgdyGn/SSya3/Y+EKm
                                                                                                                                                                                                MD5:56F65A76E1ACF6C3D2CC0698EBB3EB6D
                                                                                                                                                                                                SHA1:8AA9C4BC82DD588B9150D5E5E6B987D8A5808961
                                                                                                                                                                                                SHA-256:75705EF15CE95C89E2FFE8859C7D7F135CEDEF2837679C5F482EEC2D56B144CD
                                                                                                                                                                                                SHA-512:BE4ADC2979DF5267F8FDA21610E3EA0C5210A6A3127ED94918FDA20EDAFBC367596D5FAFFAAFC4212125588D049A4FDC867C9F0A23C1368E9FA7CB8AE961472A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozXDRcachev003......[.~3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5...1.resource://gre/modules/EnterprisePolicies.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePolicies.sys.mjs.m.......7.resource://gre/modules/EnterprisePoliciesParent.sys.mjsS.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePoliciesParent.sys.mjs.s..P....(.resource://gre

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\scriptCache.bin (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):9050156
                                                                                                                                                                                                Entropy (8bit):4.734875299814785
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:uwTv3Dxd4CqeWDc+ikpXGBmgKDkG0C6RAuAgdyR+FBG1Kl/S/qyafN7h//uTl+EL:zv8cW5IBmcAVgdyGn/SSya3/Y+EKm
                                                                                                                                                                                                MD5:56F65A76E1ACF6C3D2CC0698EBB3EB6D
                                                                                                                                                                                                SHA1:8AA9C4BC82DD588B9150D5E5E6B987D8A5808961
                                                                                                                                                                                                SHA-256:75705EF15CE95C89E2FFE8859C7D7F135CEDEF2837679C5F482EEC2D56B144CD
                                                                                                                                                                                                SHA-512:BE4ADC2979DF5267F8FDA21610E3EA0C5210A6A3127ED94918FDA20EDAFBC367596D5FAFFAAFC4212125588D049A4FDC867C9F0A23C1368E9FA7CB8AE961472A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozXDRcachev003......[.~3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5...1.resource://gre/modules/EnterprisePolicies.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePolicies.sys.mjs.m.......7.resource://gre/modules/EnterprisePoliciesParent.sys.mjsS.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePoliciesParent.sys.mjs.s..P....(.resource://gre

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\urlCache-new.bin

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2954
                                                                                                                                                                                                Entropy (8bit):4.7939742324066446
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:3xwneU3deFVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNm7J:3xFU3Mu38qgbkgbIKKRCUOt9Jrq
                                                                                                                                                                                                MD5:16CFCA0FC282FC25C2DC7C6AEADE48CB
                                                                                                                                                                                                SHA1:2CEDBB6344D33F71A9C321CDDB29F6EDB88B0BFB
                                                                                                                                                                                                SHA-256:EB8ABC241595C2B3223572FE1013E68613BD747E22D306BD231506F9A38C4340
                                                                                                                                                                                                SHA-512:8FC5D481211DC139283DBE710C852872B109C65211C1006894E94AA498EB0F951679BDD3EB83DFACBB2A673A027BB6A63D34FB6408583B6A9EEBEE9923782635
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozURLcachev003.r...P..C.a.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.i.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ft

                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\startupCache\urlCache.bin (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2954
                                                                                                                                                                                                Entropy (8bit):4.7939742324066446
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:3xwneU3deFVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNm7J:3xFU3Mu38qgbkgbIKKRCUOt9Jrq
                                                                                                                                                                                                MD5:16CFCA0FC282FC25C2DC7C6AEADE48CB
                                                                                                                                                                                                SHA1:2CEDBB6344D33F71A9C321CDDB29F6EDB88B0BFB
                                                                                                                                                                                                SHA-256:EB8ABC241595C2B3223572FE1013E68613BD747E22D306BD231506F9A38C4340
                                                                                                                                                                                                SHA-512:8FC5D481211DC139283DBE710C852872B109C65211C1006894E94AA498EB0F951679BDD3EB83DFACBB2A673A027BB6A63D34FB6408583B6A9EEBEE9923782635
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozURLcachev003.r...P..C.a.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.i.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ft

                                                                                                                                                                                                C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2393600
                                                                                                                                                                                                Entropy (8bit):7.933479637135835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:bnzYkijkaP8vRxUoDuBivcf9hKzs3YRHj6hzfaybLaXhjjv8Eb0ybBpa:bnQj2PUoD50Kyl9bLaXN86ZO
                                                                                                                                                                                                MD5:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                SHA1:7EB5E89620F4A6DE369A9667133CB2EF01D27ED3
                                                                                                                                                                                                SHA-256:6FC1848EA0691845F977875FF74A353CBAE23C75011C427720EC37659784860F
                                                                                                                                                                                                SHA-512:ADA7DCD0EB06696AE6792F7D50CA10165CC55532D31C71F2A7A19B60876E826EC22D4C3604833FF19A36DFF8CAA14AC8BB6BF4372BAFC3A6602BE9849A84E09E
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 42%
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....,........[...........@...........................[.......$...@.................................T...h....p.............................................................................................................. . .`..........................@....rsrc........p... ..................@....idata ............. ..............@... ..+.........."..............@...idnrjgyt.@...p@..:...$..............@...ssvxgfuk......[......^$.............@....taggant.0....[.."...d$.............@...........................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):26
                                                                                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\01c89b4e-558e-417d-9750-6c434c112114.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):98996
                                                                                                                                                                                                Entropy (8bit):7.702003651641397
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                                MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                                SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                                SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                                SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2DNcPleZ9unxLWQic11TF6k.zip

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2825
                                                                                                                                                                                                Entropy (8bit):7.728225462024615
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:9RabXZV//QWGPvc0CL9hGpXD6lN6mfc2abRM0aeHCjxntshsFun3KJ6xkSOV0w:WZV//Q1vc7hGpXD6lNtfc5M0sjxntshE
                                                                                                                                                                                                MD5:7053EA261E7D0EE3842EA4BCAAFCE213
                                                                                                                                                                                                SHA1:E730671D9E9538C1533A5275EDF9C8AED8A1B960
                                                                                                                                                                                                SHA-256:35A1BD2CEF88EB735158DCC815E9CC0372A86F7E6327E882F4E9DE703D8A4968
                                                                                                                                                                                                SHA-512:2587A830023E668D4B5828CDB50269FF72F94D08708EBC177791C2025EE3A0CA5157E8B51486A15557586AE0ED50E70D5D2618354D2B01113900E4DD27C90C6B
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\2DNcPleZ9unxLWQic11TF6k.zip, Author: Joe Security
                                                                                                                                                                                                Preview:PK..........OX................Cookies\..PK..........OXA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK..........OX.E..............information.txt.YYo.8.~7..@`_Z.Z.-.O.i.6n.8i6M...hG.,...c..........#.p8.7...n......RW..7S.-.Db8.........}0sD..lL.PD1.N...||?F.!\.M2Jc.G<.x4O..H0L.\.....`....W3...$...b.H.D...F..'......^h..$....,..^."..\......#.\..d|yZ;..M.tf........q....T~:.....lu...U...s[_..T..'f.....og........U....SB.DF...C..vO..x:..}1...4.{.4/3{[...."..U.].I..p0....1...W.."&..$..mI;.]^.z].{tlj[l:..*|G\Z...u....:.........*{Xq..."....2oL.>..2...../.:G.t..f..i.....].nK.zz2!m.....[]..

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\394799c6-4332-41be-bbcb-f5c2e168c93f.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:L:L
                                                                                                                                                                                                MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\47bbe3a6-2535-45a8-abd9-2418477e30ae.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):76314
                                                                                                                                                                                                Entropy (8bit):7.996159328201069
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
                                                                                                                                                                                                MD5:A4C1A16984D4A1F4D15F6A9075FE4ABD
                                                                                                                                                                                                SHA1:15E87677062BF7F7B7E67381FC2E84D460F28F6F
                                                                                                                                                                                                SHA-256:254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
                                                                                                                                                                                                SHA-512:6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\480d989b-460b-4d53-afd7-bfc620f51665.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):206855
                                                                                                                                                                                                Entropy (8bit):7.983996634657522
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
                                                                                                                                                                                                MD5:788DF0376CE061534448AA17288FEA95
                                                                                                                                                                                                SHA1:C3B9285574587B3D1950EE4A8D64145E93842AEB
                                                                                                                                                                                                SHA-256:B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
                                                                                                                                                                                                SHA-512:3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\4824691d-f754-4f73-bd54-49fc87c04062.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):405085
                                                                                                                                                                                                Entropy (8bit):7.99614029829527
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:12288:tqAULUHkZHm55TNfBj+NtsD4DLCxfh3MJnH+vRNqJAxe:trULUHkw55RpyNuD4XCxZcJH26JL
                                                                                                                                                                                                MD5:DE08F53F9FEFE226A6B388BBD6A79E9A
                                                                                                                                                                                                SHA1:E5DE37A1C2E55693CD8798BFE568047087161E13
                                                                                                                                                                                                SHA-256:05333F1F25A9256A82593F8BB15784E398876EEA065A0A5B31FFE34A05A3A729
                                                                                                                                                                                                SHA-512:3383E656B3F27015F0ECFA5A1592E94639079C5A5A1E921F3B63682528AA0C9F4EE9D6AF6FF0E2C9D3C93DB3BB451849DB7C31ED445635A3C77E7B15CD2FE2D2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:RIFF....WEBPVP8 .........*....>Q .D..!!+.{.p..ck...{..q.\.....EW..9........F..]...*.g.?................W.....~..|.....7...{.........W./.....?.?....v.....+._........+.........w............2......+...w..a_...?..}|h...w.....S........B.................M.[.......?l.....?..~.3.....?._)...>.....*.'..._...s.z............o...?...G.....x.+.......7...._.)........G./......_.w..}.....g.o.?......G.O.........?w?......'....P..............?..........O._........%.......?....S...O.O...........c....._....r?.{.......G...j.3.[...hX..*..=k.:/ZB.Eq.T..-.............%w....|<.............+..V.O.....0C.z;..?.....B....P. .V..........<........{.m.\..OR...*.:C...F.Y..#.r.R.......R..`...k.9....V.vJ{.K..#.....p...1.[...$....rM{........HU..........9..s..#z@.L.z.R'e^...r...4..V..).W..R/}b.-&..tqh.D....n._.5.!..:9..........."*7....a...\=.sn-./..h..+..Vq.<p.{...n,)A.)e.(..fm.2u....7.)..4h..Z.B....{.._...N....\A...Y..t`.M.qg|.....>.".U..O,.9...E.#.....A.c.6<...k!.g.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\938f8ba0-8641-42a0-a6a2-3133fa2ce250.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):11185
                                                                                                                                                                                                Entropy (8bit):7.951995436832936
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                                MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                                SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                                SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                                SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\a471e9d7-1582-4918-9eb2-941ecac12899.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 2560x520, components 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):822409
                                                                                                                                                                                                Entropy (8bit):7.986350662730922
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:w55RQM7afJwnqK+0ZAm029wFYvZhOEsFW24:C5+nfJkM0ZVBnZuFC
                                                                                                                                                                                                MD5:78F58244B61841737D8ECFBCB86341CF
                                                                                                                                                                                                SHA1:124371058B3625C7FA4CAC20D2A2F3BFBC0EF1C6
                                                                                                                                                                                                SHA-256:B9C6DD173B6981C7FCF019F29AF768F46C361B2C2CABD121D1B6CA5757B99CA6
                                                                                                                                                                                                SHA-512:D6DEC1E7892C4FAEC41214B58BEEEDDC6D61E4B4CF37693900B790B68CAF41EE6EE24C02DE19FCD2EF46A4FAF439A6201BF3F23CC88D6A497D2AAA9046F87AF2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:......JFIF.....H.H.....LExif..MM.*.......i...........................................................8Photoshop 3.0.8BIM........8BIM.%..................B~..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................C....................................................................C...................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\a8772096-674d-476c-bcfa-bc1d00bf8ab8.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:L:L
                                                                                                                                                                                                MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeVWl4S6kyYSYh\Cookies\Chrome_Default.txt

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):530
                                                                                                                                                                                                Entropy (8bit):6.005544722730675
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
                                                                                                                                                                                                MD5:987FB1A1830B0EB5C0D306F8A2DE9981
                                                                                                                                                                                                SHA1:8374E6320AD99C3FF177A9889F1AB75448F6EB19
                                                                                                                                                                                                SHA-256:5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
                                                                                                                                                                                                SHA-512:9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.google.com.TRUE./.TRUE.1712298002.NID.ENC893*_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=*...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893*_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=*..

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeVWl4S6kyYSYh\information.txt

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):6634
                                                                                                                                                                                                Entropy (8bit):5.503640201064438
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:x+fsbRTazcBC1IUlzhgJLbss6FwkYmGaVdzygWdr5jqukdy8/JongAY5MGfL6ypQ:xPxk84IUlzhELK8B4SDB
                                                                                                                                                                                                MD5:CFF7B646768E9EC6A8B06B6830501394
                                                                                                                                                                                                SHA1:B04700C19D039FEB110C517F2E4526A116F038C0
                                                                                                                                                                                                SHA-256:BEED10F5746497FB98DAF46CB9F5810F1543B5626C04B6C8D561F1FF53E3CCA1
                                                                                                                                                                                                SHA-512:2CDF7B33DB2E6EDCAC3C9225281B600BA425C321088B9763FFF60F5542457C003A0CBB544038212A1E873D693CA052A0B131CE5E07C23113CEE0C39EDD69D113
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Build: sigar..Version: 1.5....Date: Thu Feb 15 23:20:12 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: fa80e617a6628d74d0fc5cdab8e35cd3....Path: C:\Users\user\Desktop\jk98mGM6JH.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeVWl4S6kyYSYh....IP: 191.96.227.222..Location: US, New York City..Windows: Windows 10 Pro [x64]..Computer Name: 571345..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 15/2/2024 23:20:12..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788]..svchost.exe

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeVWl4S6kyYSYh\passwords.txt

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\b42b52d2-aada-4bc0-9691-83b000977c6c.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:PNG image data, 189 x 181, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):747458
                                                                                                                                                                                                Entropy (8bit):7.9783293279913465
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:A+KAvrvlbZMd4yOjNvin3HdjE0qt7eIv5reRZ/oKfnk7xAcKf0RDfa:A+9LJZyOj1in39ITlegIQkkCx0RW
                                                                                                                                                                                                MD5:2294846E1739A154F1677CC84FAF0B6C
                                                                                                                                                                                                SHA1:E460B3E779A48F96CC00AFC328E15881A4DDFC6B
                                                                                                                                                                                                SHA-256:7189FCFF7BD3CB1D6C2AFB3EB30213083E16CC248204672A7BEE7C5DF5A148B4
                                                                                                                                                                                                SHA-512:A6E162F9A44684A55108134BE5815CC70534728C4C7D6FCF79F9E23D24E673DD14A9BD6BD45667C8042E823962A4CBBE9DE3EC17413CB6DA42A25DFB808D408A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.PNG........IHDR.............=Z.o....PLTEGpL...........................................................................................................................................................................................................................................................................................x..........5@T................................................(((.............................................................v.............................w..........................w......................................x............................... ...v..w...................................................................................w..w..w..w...........v.................x..x..w..............w..w..y..v.................w..v..w..v..w.....w..w..w..w........w............./..q....tRNS........>..........H.8Z......f...0.d..p$.P...~..v..*M....^.,.TF&6.....kB~a.\:.......xrz..,.?"....<.J..5......@. .mW..~..........J..2.P.z.4s....@1......Xa(...hF.R...e.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1658
                                                                                                                                                                                                Entropy (8bit):5.421018029226305
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0XT5cJ5PXL0h:JIVuwEw5MUFZLBQLtyovy
                                                                                                                                                                                                MD5:B60A8A93472D911E8D7EE91D6742380E
                                                                                                                                                                                                SHA1:D3F2CF1F54C4B023BC1EA0EDB7DAF9F3C2FF6472
                                                                                                                                                                                                SHA-256:A2C963B30AE2E1082D992DE77C124171EEC6CB3904BDF7A8E82454E3991D99D0
                                                                                                                                                                                                SHA-512:67620C0E9BF7D421984EB09C5E68B9FAD5B37EEF677B2ABC61D304572A3D84EF9D62FB69BBF7CF17AEC1712483BE2CF9A843E95EE32A5E4D479265ACD0A3173F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\02zdBXl47cvzHistory

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                Entropy (8bit):0.8555577354809353
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ocy+WFSGHZtH+bF+UI3iN0RSV0k3qLyj9r9y+2SS:on+XGHZtIkUI3iGRE3qLOU+vS
                                                                                                                                                                                                MD5:2C29D964D17112F72908DD195945ECA4
                                                                                                                                                                                                SHA1:9FE90FA35C2A95061EA3D00B6EA42BA81BB23656
                                                                                                                                                                                                SHA-256:804821A65B794D8B42C80629ABEABA56BE7740349C7C8EE2C4D1F4CF6EFD97D3
                                                                                                                                                                                                SHA-512:0005AD57C1876CF34D41B27BE1183BC85BE546A54EC06BEF9968F5CA0BC305542CAB8A975300E8A3C66D2DC178E3B97A6CC020A0CFD315C697AF7F7CBA068689
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                Entropy (8bit):1.136471148832945
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\D87fZN3R3jFeWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                Entropy (8bit):1.136471148832945
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiEGekGq_N8Lks\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\02zdBXl47cvzHistory

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\2jQJv37iJ0lzCookies

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                Entropy (8bit):1.136471148832945
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\61EWU8OcULp0D6CDdq0e.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                Entropy (8bit):7.035583439961
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:xqDEvCTbMWu7rQYlBQcBiT6rprG8auu2+b+HdiJUC:xTvC/MTQYxsWR7auu2+b+HoJU
                                                                                                                                                                                                MD5:C6ED19F53D1A5C3CEEFD94E6CA7E8E87
                                                                                                                                                                                                SHA1:A4DE47DB43E4ABA2EE066D8938CD54029839757D
                                                                                                                                                                                                SHA-256:960F6B2939FF85AFB2060413635A6338DD08C182F3107574A1823AB9A268179E
                                                                                                                                                                                                SHA-512:4C7CDAF1674B1C44D01BBE384FA8F631C432E719908DDEA7BFBC3CD57D30FFBB65D87C38E2F33ED71023A0C5DCB4C138C2A157ED4303C181591C8A8B921B858F
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......e..........".................w.............@..........................0......]\....@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):3109888
                                                                                                                                                                                                Entropy (8bit):7.973902444546207
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:NTI+C9wYHzDx7P+OEh16n28EERFZk/QX6G+eEA0nfByeNSBxoTRc9EgKb1NRYOuT:NT9qhTsOm6n28EEGa6LrfByeKxoIq/Ro
                                                                                                                                                                                                MD5:880AA312796089DC66459C024727D591
                                                                                                                                                                                                SHA1:9BD32E98F7BE406F236586D56C9A86CC2F6FEF28
                                                                                                                                                                                                SHA-256:EF48B0FEFD01B25E7E76F17F0AEA226DD96E5F0DA3454E1589A0485C116F6D21
                                                                                                                                                                                                SHA-512:E40859947AC49E0CCD8315C26CEC8870855117AC2F39956819DA452F3DB13E0ED2981178F858EA0A6AAA82C2CACFC1697199B613F16DCAF5EE6DC3A46FD6B6BF
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>......8.............@.......................................@... .. .... .. .......... `......,m..x............................`.......................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........y.. ...(..................@....data....."..0...x".................@...................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\D87fZN3R3jFeWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                Entropy (8bit):1.136471148832945
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\IWPfiAXUTJTSHistory

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\KvHrxJ77cmUgLogin Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                Entropy (8bit):6.580732602823796
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:7qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgapTK:7qDEvCTbMWu7rQYlBQcBiT6rprG8atK
                                                                                                                                                                                                MD5:791ED44F9B3836A68F79B028EF7C49CB
                                                                                                                                                                                                SHA1:B885B0AC78EC917B259DDCA830DA0DA112A12BE5
                                                                                                                                                                                                SHA-256:0ECEABC886E72C33776BB1F6FE68E97E5C8554852941061CC3AC26A74B5C665A
                                                                                                                                                                                                SHA-512:35F0B529075964F8AACB3C904649EE0314F9038EED3E214211978BD5DD17C05F4C5C8FB967CBC1E4784F06483CC564FDFE3874C24717E75A89D044D482E542C5
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...~..e.........."..........R......w.............@..........................`...........@...@.......@.....................d...|....@..0........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...0....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\QdX9ITDLyCRBWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                Entropy (8bit):1.136471148832945
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\UPG2LoPXwc7OWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\ZunTSaNJLBVfWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\b2H5rX9tWHjbJEBjMEvH.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2313728
                                                                                                                                                                                                Entropy (8bit):7.960248251430647
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:vl9a2WxJEoRrNGmMP7UFFO/ssvEY2/9UPAuz6hlf8KuRwuJGVPt:+GohNGmmyFkssvEYMo+hFJuRpMP
                                                                                                                                                                                                MD5:AAB2D2B3DFC6FB51912C1C12E66E0134
                                                                                                                                                                                                SHA1:FF2567E8DE9D9821F4EAEC8420A35DBCF1859822
                                                                                                                                                                                                SHA-256:66961502C91CEFBF91BCD0349D3A1A43B661BF85A4CAD7D7832F8EBBE4DADAEA
                                                                                                                                                                                                SHA-512:305FA39E9E18743EF05040F3656954F05B74A573B02BE64CCFD5245C3433C7316EF01883E2141FF45563F4751E542B5143B980DE6FA93BCE13F7A1ED0F8646FC
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......0Y...........@..........................`Y.....R.#...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@+.........................@...jyzrikla. ....?.....................@...swzyazqz..... Y......(#.............@....taggant.0...0Y.."...,#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\o0qT3dWYBP7ZHistory

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\oOPEmFmu_xsJCookies

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                Entropy (8bit):0.8508558324143882
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
                                                                                                                                                                                                MD5:933D6D14518371B212F36C3835794D75
                                                                                                                                                                                                SHA1:92D056D912B3C0260D379330D3CC0359B57A322B
                                                                                                                                                                                                SHA-256:55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
                                                                                                                                                                                                SHA-512:EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\pSE1jchbiT9aHistory

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\suOrwW4ZcUbjWeb Data

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1750528
                                                                                                                                                                                                Entropy (8bit):7.944242713948799
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:ssB0EgavojCNbSNqAb4SboO9A98YzRpcufYJCd78dkBQDuE59sSI8VD2Q21e:sHavoGNGj8ScOSNppYO+QQHfZ12Q21
                                                                                                                                                                                                MD5:1C8A50F3E51F6AE258F38752193B1448
                                                                                                                                                                                                SHA1:8113D74005BB56D0C9A75BB7435FC060596354D7
                                                                                                                                                                                                SHA-256:C37894BBE69843F05952AD09687DD254932647A9E1E0C65E986FCE438E120508
                                                                                                                                                                                                SHA-512:2FD3817B8CFEB1FB41F4F0FD832BC5B2B7C1B1E1A3BFFC13587186176A8AF53EEA99ABB96E2EB6C7C104A80BAAA70B50367209B2FC37A7E6AA2D57D6CA5CD519
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............E.. ...`....@.. ........................E...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...cxfojuyk..... +..z...:..............@...begfdfyp. ....E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.4593089050301797
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                                                                                                                                MD5:D910AD167F0217587501FDCDB33CC544
                                                                                                                                                                                                SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                                                                                                                                SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                                                                                                                                SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\rage131MP.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):13
                                                                                                                                                                                                Entropy (8bit):2.7773627950641693
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:L3zQRXQ:L8RA
                                                                                                                                                                                                MD5:06CE2FA6A25FF4FC9D864FCAA1DD5608
                                                                                                                                                                                                SHA1:8DC319B8C66AA1CC72A5304C7B6E210B22C88B5F
                                                                                                                                                                                                SHA-256:930F70811F5D302816A1F1665D0E5C8C7332B5AEC48DDD0F3C938E446395EC8D
                                                                                                                                                                                                SHA-512:FE626BFE1B882AF36E400EB4282040AD665B9207D6667A40E7900F5CF36F7FDFB853E360B2FFCD5B85AB96513AA483BD0FA0B747DF5ABE408F2E021A4709B774
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1708040054232

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\scoped_dir9776_1621636451\938f8ba0-8641-42a0-a6a2-3133fa2ce250.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):11185
                                                                                                                                                                                                Entropy (8bit):7.951995436832936
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                                MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                                SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                                SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                                SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\scoped_dir9776_1621636451\CRX_INSTALL\manifest.json

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):626
                                                                                                                                                                                                Entropy (8bit):4.456850889662404
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:5AsY9g1uFIX1UsRMKmWRA5gp5ccoPGnuVFRXgp5cznR2GnjQDc:5+m1uF2+sAWA5cuGuVjXcqn4G8g
                                                                                                                                                                                                MD5:B9D00380C0947D7BA5FD1EFCBB8A7347
                                                                                                                                                                                                SHA1:FA8EF5BCE53E46999CDD957DA6113B37D04E116D
                                                                                                                                                                                                SHA-256:279BF453DD0572DCF4A326CB7DF9FA9D296A2921EF96ABDB1956A813268D78CB
                                                                                                                                                                                                SHA-512:577B235564C77BE3050F2AA0E1B6986BCD3D38B09A792A01F943D7D85EFCCC43BDC9659AAA3B81311BDDC1BCCE47FAF4F3D3ECA77D955EE2FE93FA6B095F0C13
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "version": "1.2.1",.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "content_scripts": [.. {.. "matches": [.. "https://chrome.google.com/webstore/*".. ],.. "js": [.. "content.js".. ].. },.. {.. "matches": [.. "https://chromewebstore.google.com/*".. ],.. "js": [.. "content_new.js".. ].. }.. ],.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx"..}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\scoped_dir9776_791321247\01c89b4e-558e-417d-9750-6c434c112114.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):98996
                                                                                                                                                                                                Entropy (8bit):7.702003651641397
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                                MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                                SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                                SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                                SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):491284
                                                                                                                                                                                                Entropy (8bit):7.997725234203649
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
                                                                                                                                                                                                MD5:09372174E83DBBF696EE732FD2E875BB
                                                                                                                                                                                                SHA1:BA360186BA650A769F9303F48B7200FB5EACCEE1
                                                                                                                                                                                                SHA-256:C32EFAC42FAF4B9878FB8917C5E71D89FF40DE580C4F52F62E11C6CFAB55167F
                                                                                                                                                                                                SHA-512:B667086ED49579592D435DF2B486FE30BA1B62DDD169F19E700CD079239747DD3E20058C285FA9C10A533E34F22B5198ED9B1F92AE560A3067F3E3FEACC724F1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:PK...........V...,.}..........gmpopenh264.dll..|.U.8.I.....`....&l.Vpm.5Sf.N.(.."..YXY.%....V:;.......>....u.-...U....(.E.?*.ES.R..?...{'i...]}.}>._?Mr.....s.3s'....Ng.O0..m..?...z..4~{...w...H.\3{....U?*Y..K..+W.-K......,_i.g.k....NJLL.j0F..y..[?}1..........'.G^.#..^.C..{1.~..>.i..=............>}i.......h..h..t..O..^>w..PY.n.e.>...%Q.3....&H.d9....tqZ..pg3....G@u!.........[.4h....E.w.Y...~_1.^.#!f.+,.au......,._..:&...{N..1..~p..~?..DJ..T.".,.vR....u..P........8D;.,.BOp..........D..'...q*..l...;..6$.........9&.<.bU....dExynP..KK.........7~M.X....?.-Q..*.....zs......>..\...bv...y...s..+zN.Kr.(. .Ee.QRco.8..8.~..o..D.OT.5......O.gC.F.3..E......('..>......2Eu.5]l.t}.`...:j.....IW.u...J.....H.m.R.Tz.....O...*..Q...9..j.c.Uc...U8gD..q.^.3..|..Q.g[..Q6Q.q.....GBg..F[.\...D.C.?:1.}.../.t ..`.....}..........@...8c.G.....o. .......TyK.....sS.S..a.a..LR.0.k,.</;"...L.!WDp.M....8r..S..kq..o.0.m.-..,Z.[...>.G....P~.|.7TR...Ug.7.j......8Q>-.u..

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4419
                                                                                                                                                                                                Entropy (8bit):4.9317330315284735
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLMe58P:gXiNFS+OcUGOdwiOdwBjkYLMe58P
                                                                                                                                                                                                MD5:765CF68D8EE874564A9A8DC072ABF149
                                                                                                                                                                                                SHA1:CF21601755AA3DB288C5A52ADEE3C9586DEE5E26
                                                                                                                                                                                                SHA-256:252CD769D24BC1989C1EB47E3ADBC77DB536FD9A49ACF94CE55A30CDBED39090
                                                                                                                                                                                                SHA-512:D8AE161DAB3F8862B79BE9DC47B1C01822FD5CC42636A5C670334DB58EA15E4255865FBC450C18B3779B23E377B54BF160E8D9750502D68A751F5E5078891508
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4419
                                                                                                                                                                                                Entropy (8bit):4.9317330315284735
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLMe58P:gXiNFS+OcUGOdwiOdwBjkYLMe58P
                                                                                                                                                                                                MD5:765CF68D8EE874564A9A8DC072ABF149
                                                                                                                                                                                                SHA1:CF21601755AA3DB288C5A52ADEE3C9586DEE5E26
                                                                                                                                                                                                SHA-256:252CD769D24BC1989C1EB47E3ADBC77DB536FD9A49ACF94CE55A30CDBED39090
                                                                                                                                                                                                SHA-512:D8AE161DAB3F8862B79BE9DC47B1C01822FD5CC42636A5C670334DB58EA15E4255865FBC450C18B3779B23E377B54BF160E8D9750502D68A751F5E5078891508
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\Telemetry.FailedProfileLocks.txt

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5308
                                                                                                                                                                                                Entropy (8bit):6.599374203470186
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
                                                                                                                                                                                                MD5:EB56C2F4DA9435F3D5574161F414CD17
                                                                                                                                                                                                SHA1:74A8FC3EC0559740FD9D835B638354985E2DEAB6
                                                                                                                                                                                                SHA-256:394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
                                                                                                                                                                                                SHA-512:DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5308
                                                                                                                                                                                                Entropy (8bit):6.599374203470186
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
                                                                                                                                                                                                MD5:EB56C2F4DA9435F3D5574161F414CD17
                                                                                                                                                                                                SHA1:74A8FC3EC0559740FD9D835B638354985E2DEAB6
                                                                                                                                                                                                SHA-256:394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
                                                                                                                                                                                                SHA-512:DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                Entropy (8bit):3.91829583405449
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                Entropy (8bit):3.91829583405449
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 9, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 9
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):229376
                                                                                                                                                                                                Entropy (8bit):0.8262783609690614
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:Sb1zkVmvQhyn+Zoz67XdZ60ubZI/A333JwMMUNlBN80/LKXXZGZjxmWt:SbqMr1CRo
                                                                                                                                                                                                MD5:AA3A15FA6CD212AEF9C8827489A26665
                                                                                                                                                                                                SHA1:881DA5A6FB9379411CF94F9A93F46DAD5D4FB18A
                                                                                                                                                                                                SHA-256:5CC7954D40877885C133D74E62641EB3DD44F7E9957B65B69EAA5B887402E42A
                                                                                                                                                                                                SHA-512:8ED520E83D544C27B89C94A17732E1142416D5302EDF0A623EAFCAC1A6341E5D9A87482CA5A31DF1B0AA6DA0EFD1E95CAD1509D41CA576D9C802ED0F0E85B858
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db-journal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):229944
                                                                                                                                                                                                Entropy (8bit):0.7382307388693716
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:7hWQjIA333JwMMUNlBN80/LKXwX1zkVmvQhyn+Zoz677:QMr1CRGS
                                                                                                                                                                                                MD5:BB70E6313B42451E8D790DF51BCF1177
                                                                                                                                                                                                SHA1:D1499A249CFED7A7D216EACB0D311FE35DB9EB7B
                                                                                                                                                                                                SHA-256:10D333602991FAC237B48C41EAA404338B29097E7C9BAA612FC9122BE2A2CAB8
                                                                                                                                                                                                SHA-512:DD29279CC3BD39A40F818CE6556DFE5A626523CA8F7D1BE666AB6C07CD58848464B0E5055D70C39E9A7DFC7F2D912672C2C4491D7C41F095DBD24FA34C6B219F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... .c.....n.B`..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R..R.....k....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):262144
                                                                                                                                                                                                Entropy (8bit):0.04905141882491872
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
                                                                                                                                                                                                MD5:8736A542C5564A922C47B19D9CC5E0F2
                                                                                                                                                                                                SHA1:CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
                                                                                                                                                                                                SHA-256:97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
                                                                                                                                                                                                SHA-512:99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite-journal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):33288
                                                                                                                                                                                                Entropy (8bit):0.30901762819405565
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:7+tW6LCvwae+Q8Uu50xj0aWe9LxYkKA25Q52:7MW6awae+QtMImelekKDa52
                                                                                                                                                                                                MD5:3A3A0F3DA751C073179EB8E24C8C49F0
                                                                                                                                                                                                SHA1:DA4A2C93D5CD4D20BE9A1BF8A10F961CF7280425
                                                                                                                                                                                                SHA-256:41B423DBAB9742ECBEF4397566166265C82E6B2AD2C04A4394A2A7EE9B7A2BFE
                                                                                                                                                                                                SHA-512:504A2A7BBCEFB480E9DA6DD5AF6E5B9833F36C4D144F8769F5F5B6B7326AEE7C9AE38169F5DEEA3F70793310C0262C92DC95B6DB1F02B5C4CA1178C8F3EF61EA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... .c.....)>......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):524288
                                                                                                                                                                                                Entropy (8bit):0.018197345594952233
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lOSR:DQAsff32mNVpP965Ra8KN0MG/lOSR
                                                                                                                                                                                                MD5:54A276F2743942D9AD17E103184E1149
                                                                                                                                                                                                SHA1:CD1D7B7467A487354A5637AD1749DC96EA7B9275
                                                                                                                                                                                                SHA-256:95EB4ECDCF8BE9B94C53793AD14255C10350316562E80F5A9948CF65574AC0C0
                                                                                                                                                                                                SHA-512:12153DED30AB823BAEAE143D4737F423552CFBC2A9E9A2638EAE9820033AD1D3097349AE7B9D4E83EC7961E6293090FDFF066F1A31B886A8993240E0D1EFC813
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.04527263952969573
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Gblo/AyYKUHYllblo/AyYKMlY89//9lklklklklklZlilslq/lpljltl9L/:GlyYKUHIllyYKMlY89X4lilslq
                                                                                                                                                                                                MD5:45DFD42E36608E5A5A33450DF9E19598
                                                                                                                                                                                                SHA1:75C95CD763262510DB605566F5D85101DE14C91C
                                                                                                                                                                                                SHA-256:847795136893C645E94453ADA643608516B569DECC36880A08877F7B717A92A7
                                                                                                                                                                                                SHA-512:66E2D70F9F4891289A07F5A4961C57BDEA6790EAEAA6C3FFB71751DEFB500D1EB58CC90224E3FEBEDB12ED7ACB2225BB88221D96D95CDF9F826761701EE9CE8F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-......................U.\..M~.../f.W.$^.m..I...-......................U.\..M~.../f.W.$^.m..I.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):524704
                                                                                                                                                                                                Entropy (8bit):0.07829403347344387
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:vlOwjaAjn1vIPAjJBn1uwPAjNGU+BAn1uwPAmGU+Bh1uwPAAa3tGU+B:NOwj1lKshb3
                                                                                                                                                                                                MD5:BDE794CC1835C76C258C55D579124C74
                                                                                                                                                                                                SHA1:82717B0413F6BD8F51252328CD01E9A77FF4965E
                                                                                                                                                                                                SHA-256:DFA37C303E29DF5E166A3EA2E0AD3E66D2BF6B379EB380D6ABDBDC1432798E57
                                                                                                                                                                                                SHA-512:1F4DAF55C4EB935A32AEB58A59428940815D47B616C10040D20E7D6697B2F4FED452F039B7CECBF97CB3BF009A8BC5226CF3D16E3BAC680653FA867F58408732
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:7....-............./f.W..X....}............/f.W..n.E\..>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):66
                                                                                                                                                                                                Entropy (8bit):4.837595020998689
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):66
                                                                                                                                                                                                Entropy (8bit):4.837595020998689
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\aborted-session-ping (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):50594
                                                                                                                                                                                                Entropy (8bit):5.255421335924768
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:IdahV+7QWJze+D4o3AT26Pf9oK/iH4VYlNhnzFSJHf+:aK4Q6yM3hFv4VYlNhnzFSJm
                                                                                                                                                                                                MD5:6420A434779F656A62038961521F8FB6
                                                                                                                                                                                                SHA1:28395A5EDEE1F00296642EDDC08C784C15835904
                                                                                                                                                                                                SHA-256:C8B6CE4612A0C70DB835EE1100ADED9732DC14C27C5D893F1889CD7F1BDF705C
                                                                                                                                                                                                SHA-512:C665C904713A833A49FE351085F08B8B41AC4E50CF8152FC2866AFB599421CA33F9EB4F812B8E149581EB49B3A90A9310277760C11B72122F2920FCAA6B0FDA9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"type":"main","id":"3b1b5f7e-0fd2-4fad-a94f-a150aedbbf9a","creationDate":"2024-02-15T23:35:04.376Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":8886,"start":4408133,"main":4408979,"selectProfile":4409293,"afterProfileLocked":4409296,"startupCrashDetectionBegin":4410825,"firstPaint":4423399,"firstPaint2":4422751,"sessionRestoreInit":4417536,"sessionRestored":4424153,"createTopLevelWindow":4411516,"AMI_startup_begin":8818990,"XPI_startup_begin":8818994,"XPI_bootstrap_addons_begin":8819112,"XPI_bootstrap_addons_end":8819368,"XPI_startup_end":8819368,"AMI_startup_end":8819368,"XPI_finalUIStartup":8825577,"sessionRestoreInitialized":8825580,"delayedStartupStarted":8831451,"delayedStartupFinished":8832020,"startupInterrupted":0,"debuggerAttached":0,"s

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\aborted-session-ping.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):50594
                                                                                                                                                                                                Entropy (8bit):5.255421335924768
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:IdahV+7QWJze+D4o3AT26Pf9oK/iH4VYlNhnzFSJHf+:aK4Q6yM3hFv4VYlNhnzFSJm
                                                                                                                                                                                                MD5:6420A434779F656A62038961521F8FB6
                                                                                                                                                                                                SHA1:28395A5EDEE1F00296642EDDC08C784C15835904
                                                                                                                                                                                                SHA-256:C8B6CE4612A0C70DB835EE1100ADED9732DC14C27C5D893F1889CD7F1BDF705C
                                                                                                                                                                                                SHA-512:C665C904713A833A49FE351085F08B8B41AC4E50CF8152FC2866AFB599421CA33F9EB4F812B8E149581EB49B3A90A9310277760C11B72122F2920FCAA6B0FDA9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"type":"main","id":"3b1b5f7e-0fd2-4fad-a94f-a150aedbbf9a","creationDate":"2024-02-15T23:35:04.376Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":8886,"start":4408133,"main":4408979,"selectProfile":4409293,"afterProfileLocked":4409296,"startupCrashDetectionBegin":4410825,"firstPaint":4423399,"firstPaint2":4422751,"sessionRestoreInit":4417536,"sessionRestored":4424153,"createTopLevelWindow":4411516,"AMI_startup_begin":8818990,"XPI_startup_begin":8818994,"XPI_bootstrap_addons_begin":8819112,"XPI_bootstrap_addons_end":8819368,"XPI_startup_end":8819368,"AMI_startup_end":8819368,"XPI_finalUIStartup":8825577,"sessionRestoreInitialized":8825580,"delayedStartupStarted":8831451,"delayedStartupFinished":8832020,"startupInterrupted":0,"debuggerAttached":0,"s

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\data.safe.bin (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12788
                                                                                                                                                                                                Entropy (8bit):4.3057180374333885
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:L9vnbosSyxYoPbJAcD2uVk5PJ25+gAQ9D2EHRSSbpbWbrbzt:xbosIoPijYgQ9D2EHRvbpbWbrbzt
                                                                                                                                                                                                MD5:93C279625224A5BD439D66B216F38EDC
                                                                                                                                                                                                SHA1:3948025D0F0E8BD04CC0A3953F3F5FA5FBB4D03D
                                                                                                                                                                                                SHA-256:067928177E3EACBA7C60706B6E1D45C64E8DF1ECF4248621468900974EB1D4C0
                                                                                                                                                                                                SHA-512:050CC466043FC692CBAAA0A3DB5189996622C9C1E2512F677000ED7B8A8BC3F91E4B429458771E592AF4A6A11CAD23A6C34F9A0EF6087476DF9DB120C0AA65E5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.................app....:.......#.......baseline#legacy.telemetry.client_id9........0...........$.......7340e351-fad3-4a0f-b554-971fbfafe8fb!.......events#legacy.telemetry.client_id9........0...........$.......7340e351-fad3-4a0f-b554-971fbfafe8fb........events#urlbar.pref_max_results.............................*.......events#urlbar.pref_suggest_data_collection......................'.......events#urlbar.pref_suggest_nonsponsored......................$.......events#urlbar.pref_suggest_sponsored......................#.......events#urlbar.pref_suggest_topsites..............................glean_client_info#app_build#............................20230927232528........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................118.0.1........glean_client_info#architecture.............................x86_64........glean_client_info#build_date2........)...................1970-01-01T00:00:00+00:00............glean_cl

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):12788
                                                                                                                                                                                                Entropy (8bit):4.3057180374333885
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:L9vnbosSyxYoPbJAcD2uVk5PJ25+gAQ9D2EHRSSbpbWbrbzt:xbosIoPijYgQ9D2EHRvbpbWbrbzt
                                                                                                                                                                                                MD5:93C279625224A5BD439D66B216F38EDC
                                                                                                                                                                                                SHA1:3948025D0F0E8BD04CC0A3953F3F5FA5FBB4D03D
                                                                                                                                                                                                SHA-256:067928177E3EACBA7C60706B6E1D45C64E8DF1ECF4248621468900974EB1D4C0
                                                                                                                                                                                                SHA-512:050CC466043FC692CBAAA0A3DB5189996622C9C1E2512F677000ED7B8A8BC3F91E4B429458771E592AF4A6A11CAD23A6C34F9A0EF6087476DF9DB120C0AA65E5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.................app....:.......#.......baseline#legacy.telemetry.client_id9........0...........$.......7340e351-fad3-4a0f-b554-971fbfafe8fb!.......events#legacy.telemetry.client_id9........0...........$.......7340e351-fad3-4a0f-b554-971fbfafe8fb........events#urlbar.pref_max_results.............................*.......events#urlbar.pref_suggest_data_collection......................'.......events#urlbar.pref_suggest_nonsponsored......................$.......events#urlbar.pref_suggest_sponsored......................#.......events#urlbar.pref_suggest_topsites..............................glean_client_info#app_build#............................20230927232528........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................118.0.1........glean_client_info#architecture.............................x86_64........glean_client_info#build_date2........)...................1970-01-01T00:00:00+00:00............glean_cl

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\background-update

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1154
                                                                                                                                                                                                Entropy (8bit):4.633428067897242
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:YSiMi1kDEtmdHbDEt1cfHbDytD7mpDyt1cfHn:Ybr1kgubgUfb2c2Ufn
                                                                                                                                                                                                MD5:253A6E9B2FDC578578BE3E7BD8C95C65
                                                                                                                                                                                                SHA1:B5859D70A7105AD263ACBECA5A7F2BD8DA16E0D2
                                                                                                                                                                                                SHA-256:952269B3BADFC3312FC9FB6AE2BCCDCFB4E9D6A299E49C998FFDABAFC98A422B
                                                                                                                                                                                                SHA-512:B9DD084AB2D2AECA200A9394C3C373DAA8142F019D599B899094B6338050AC55E49E0BFE0378C96EB03FE4274CC10213BDB26B83EF7661BC4DE0C648C0B0880F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"timestamp":24025,"category":"nimbus_events","name":"enrollment","extra":{"experiment":"extensions-migration-in-import-wizard-116-rollout","experiment_type":"rollout","branch":"control","enrollment_id":"b1d75314-5ef2-444b-9c96-b353ce28dd7c"}}.{"timestamp":34398,"category":"nimbus_events","name":"validation_failed","extra":{"experiment":"next-generation-accessibility-user-powering-screen-readers","reason":"invalid-feature","feature":"accessibilityCache"}}.{"timestamp":34398,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","experiment":"next-generation-accessibility-user-powering-screen-readers-and-other-ats-copy","feature":"accessibilityCache"}}.{"timestamp":37502,"category":"nimbus_events","name":"validation_failed","extra":{"feature":"accessibilityCache","experiment":"next-generation-accessibility-user-powering-screen-readers","reason":"invalid-feature"}}.{"timestamp":37502,"category":"nimbus_events","name":"validation_failed","extra":{"

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\events

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1228
                                                                                                                                                                                                Entropy (8bit):4.638426844787651
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:YSgDiMi1kDEtmdHbDEt1cfHbDytD7mpDyt1cfHn:YjWr1kgubgUfb2c2Ufn
                                                                                                                                                                                                MD5:588B7456877DC8AF377430C5712F8BD2
                                                                                                                                                                                                SHA1:0ECC4CD9CB0AA5CAAF6E1C2706C3AFC6544982C2
                                                                                                                                                                                                SHA-256:8FC43E682A2E0F92FFED529642BDCDB00735B578E31DE3E27BADD1A4E6E725F5
                                                                                                                                                                                                SHA-512:9ACF2486B773C6EA70B8EB8885F74A955E277368BD4451207869DE854A769668D33535C2F52A57890155743D67078A01DF8A9FCE5C3BA7C9C721BD7708CAC51F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"timestamp":0,"category":"fog.validation","name":"validate_early_event"}.{"timestamp":24025,"category":"nimbus_events","name":"enrollment","extra":{"experiment":"extensions-migration-in-import-wizard-116-rollout","experiment_type":"rollout","branch":"control","enrollment_id":"b1d75314-5ef2-444b-9c96-b353ce28dd7c"}}.{"timestamp":34398,"category":"nimbus_events","name":"validation_failed","extra":{"experiment":"next-generation-accessibility-user-powering-screen-readers","reason":"invalid-feature","feature":"accessibilityCache"}}.{"timestamp":34398,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","experiment":"next-generation-accessibility-user-powering-screen-readers-and-other-ats-copy","feature":"accessibilityCache"}}.{"timestamp":37502,"category":"nimbus_events","name":"validation_failed","extra":{"feature":"accessibilityCache","experiment":"next-generation-accessibility-user-powering-screen-readers","reason":"invalid-feature"}}.{"timesta

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\1bef685a-e82c-4781-8739-d9ec0de152e1 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (872)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):942
                                                                                                                                                                                                Entropy (8bit):4.986595620221564
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:BGFRKHV8U+8M4vMPjTAaUmBpjZLNk5dGAuY0H:R+UtM4KgCBp4CG0H
                                                                                                                                                                                                MD5:F41AD34B8C0C40998D5D4789A0568C5C
                                                                                                                                                                                                SHA1:2576D57C61AE7EBA05672D8036C0DB44AC0C0A86
                                                                                                                                                                                                SHA-256:151D7CE8989530EEF864F49924A31CEDF617790648DAA4197F559D28226E7281
                                                                                                                                                                                                SHA-512:9AD02C666B2BCD48C2C5355B825B62830B1718F3D4F0E4462582CA80D0F00C04B0F5AE53C6F1AD10B32302F4365327664CE33BD11E6841E37652B1C2B6590E33
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/newtab/1/1bef685a-e82c-4781-8739-d9ec0de152e1.{"ping_info":{"seq":6,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:35+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","build_date":"1970-01-01T00:00:00+00:00","first_run_date":"2023-10-05+02:00","locale":"en-US","app_display_version":"118.0.1","app_channel":"release","app_build":"20230927232528","architecture":"x86_64","os":"Windows","os_version":"10.0","windows_build_number":19045},"metrics":{"boolean":{"pocket.is_signed_in":false,"pocket.sponsored_stories_enabled":true,"topsites.enabled":true,"pocket.enabled":true,"newtab.search.enabled":true,"topsites.sponsored_enabled":true},"string_list":{"newtab.blocked_sponsors":[]},"quantity":{"topsites.rows":1},"string":{"newtab.homepage_category":"enabled","newtab.locale":"en-US","newtab.newtab_category":"enabled"}}}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\3d5e2044-5d73-4c87-a4a2-385d595b4387 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1488)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1560
                                                                                                                                                                                                Entropy (8bit):5.032456478335483
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:BGyk8bP/ClpWSj+/WLX+ghuJgw+Rhv1+JT+JZiXG1AUTGjTAU2MVdM4RBwoYip8:k8LHSa/WLu4GOHdT+UKgsdM4RbYip8
                                                                                                                                                                                                MD5:CB8E32213000E5E57883677226EF2368
                                                                                                                                                                                                SHA1:7384499C0CF74042072F37F17D41D6AA0BE69BFA
                                                                                                                                                                                                SHA-256:F84CF220ACCCA1ADE56873095D182D6257E7075961BA2C352979F8707B1E3B58
                                                                                                                                                                                                SHA-512:EA09D0FEC0EB3FFA367FF327A25F01285872AE8BCBC97A0F1AA8FCA5C4DEEBE6ECA10DBB751978D0DA90E91B800B7D1845AC0E8046D7E02BD55DC3BB980BEA71
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/baseline/1/3d5e2044-5d73-4c87-a4a2-385d595b4387.{"ping_info":{"seq":2,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:35+01:00","reason":"active","experiments":{"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"b1d75314-5ef2-444b-9c96-b353ce28dd7c","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","locale":"en-US","app_b

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\9a79d70f-85b2-4e0d-986e-5df43330e7f9 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (2799)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2869
                                                                                                                                                                                                Entropy (8bit):4.915914228886047
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:dhxoWLu4KJSjyXUtM4rO/FFmbIniSGBRWLuepThHox:d44CSjyfKOrOdSyUT6x
                                                                                                                                                                                                MD5:813895EF7C968C2E4B26339AB9C5AB93
                                                                                                                                                                                                SHA1:EE9B6ACCB3C62F847490044C60909374EC002EE8
                                                                                                                                                                                                SHA-256:C7C7F257DFAD7878ED137AF96B32A543ADA83D927E69F56B37B8EF4E7342F904
                                                                                                                                                                                                SHA-512:CDB5F52B281C7C07A4E1B8CFFD49D1B08BFB9F2590C31AACE47ED4D4ECEDB850F32F602A5AC3891488355E39BCDDA70650D304FB0808E98C35F66A3132447BD6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/events/1/9a79d70f-85b2-4e0d-986e-5df43330e7f9.{"ping_info":{"seq":1,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:34+01:00","reason":"startup","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","os":"Windows","app_build":"20230927232528","app_display_version":"118.0.1","app_channel":"release","os_version":"10.0","architecture"

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\a1eef2b7-1be1-45c9-93ee-1bdd03805783 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1538)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1618
                                                                                                                                                                                                Entropy (8bit):5.092227746684785
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:BGIuT/C+JZiXG8+JwJgw+RhvRWSj+/WLX+ghXUPrGjMLAUmG7QkHaKLjNF9TSXKS:1QR8VOH4Sa/WLu4XUPKlLETa+ZTWv7qk
                                                                                                                                                                                                MD5:7974047AD6CB398367CF4AAA790B80B7
                                                                                                                                                                                                SHA1:D2B2045A0C382608C92587F98BD72FB1EA55A433
                                                                                                                                                                                                SHA-256:5459CACFEB4695FA524909E7B8C287CF336ECC5CDFCAC1F29F2923E17562A1D9
                                                                                                                                                                                                SHA-512:AB9C5B10C5BBD3AB0B460E33985B28D69961CBE86BD652C281AC57E8C8610CE99AB0A8F32CA8D1A40AF345F77B4F9704814C50B9DEA931228E2F12B61EFDA3D3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/a1eef2b7-1be1-45c9-93ee-1bdd03805783.{"ping_info":{"seq":10,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:35+01:00","experiments":{"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"b1d75314-5ef2-444b-9c96-b353ce28dd7c","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","build_date":"1970-01-01T00:00:0

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\ce258073-abaa-4281-aebf-03728e033789 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1538)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1618
                                                                                                                                                                                                Entropy (8bit):5.094771694530805
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:rbQHSaoYyDWLu4XUn7tgDHaZ+TWv7qVbD:0S9Yy34GU6Z+TWv+VbD
                                                                                                                                                                                                MD5:B0F673B6E37FD1D07310A1A467F81A69
                                                                                                                                                                                                SHA1:55E2C206EFA57016D162F459410C40B37C96C056
                                                                                                                                                                                                SHA-256:42A74A0A68D6850D55DE3C3063BC9C884B84745F1C98A7CC7517FA53F31C04B8
                                                                                                                                                                                                SHA-512:3C38E30CA44541842BBD590F267A0DEBF513A63DB99AF6EAF3FECA394357F82573EA8BC3AEBF6D416DE0C201A1DA7C45825FB13A9D05E589E80E5BD705BE675F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/ce258073-abaa-4281-aebf-03728e033789.{"ping_info":{"seq":11,"start_time":"2024-02-16T00:35+01:00","end_time":"2024-02-16T00:35+01:00","experiments":{"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"b1d75314-5ef2-444b-9c96-b353ce28dd7c","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"type":"nimbus-nimbus","enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","first_run_date":"2023-10-05+02:

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\1bef685a-e82c-4781-8739-d9ec0de152e1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (872)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):942
                                                                                                                                                                                                Entropy (8bit):4.986595620221564
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:BGFRKHV8U+8M4vMPjTAaUmBpjZLNk5dGAuY0H:R+UtM4KgCBp4CG0H
                                                                                                                                                                                                MD5:F41AD34B8C0C40998D5D4789A0568C5C
                                                                                                                                                                                                SHA1:2576D57C61AE7EBA05672D8036C0DB44AC0C0A86
                                                                                                                                                                                                SHA-256:151D7CE8989530EEF864F49924A31CEDF617790648DAA4197F559D28226E7281
                                                                                                                                                                                                SHA-512:9AD02C666B2BCD48C2C5355B825B62830B1718F3D4F0E4462582CA80D0F00C04B0F5AE53C6F1AD10B32302F4365327664CE33BD11E6841E37652B1C2B6590E33
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/newtab/1/1bef685a-e82c-4781-8739-d9ec0de152e1.{"ping_info":{"seq":6,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:35+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","build_date":"1970-01-01T00:00:00+00:00","first_run_date":"2023-10-05+02:00","locale":"en-US","app_display_version":"118.0.1","app_channel":"release","app_build":"20230927232528","architecture":"x86_64","os":"Windows","os_version":"10.0","windows_build_number":19045},"metrics":{"boolean":{"pocket.is_signed_in":false,"pocket.sponsored_stories_enabled":true,"topsites.enabled":true,"pocket.enabled":true,"newtab.search.enabled":true,"topsites.sponsored_enabled":true},"string_list":{"newtab.blocked_sponsors":[]},"quantity":{"topsites.rows":1},"string":{"newtab.homepage_category":"enabled","newtab.locale":"en-US","newtab.newtab_category":"enabled"}}}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\3d5e2044-5d73-4c87-a4a2-385d595b4387

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1488)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1560
                                                                                                                                                                                                Entropy (8bit):5.032456478335483
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:BGyk8bP/ClpWSj+/WLX+ghuJgw+Rhv1+JT+JZiXG1AUTGjTAU2MVdM4RBwoYip8:k8LHSa/WLu4GOHdT+UKgsdM4RbYip8
                                                                                                                                                                                                MD5:CB8E32213000E5E57883677226EF2368
                                                                                                                                                                                                SHA1:7384499C0CF74042072F37F17D41D6AA0BE69BFA
                                                                                                                                                                                                SHA-256:F84CF220ACCCA1ADE56873095D182D6257E7075961BA2C352979F8707B1E3B58
                                                                                                                                                                                                SHA-512:EA09D0FEC0EB3FFA367FF327A25F01285872AE8BCBC97A0F1AA8FCA5C4DEEBE6ECA10DBB751978D0DA90E91B800B7D1845AC0E8046D7E02BD55DC3BB980BEA71
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/baseline/1/3d5e2044-5d73-4c87-a4a2-385d595b4387.{"ping_info":{"seq":2,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:35+01:00","reason":"active","experiments":{"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"b1d75314-5ef2-444b-9c96-b353ce28dd7c","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","locale":"en-US","app_b

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\9a79d70f-85b2-4e0d-986e-5df43330e7f9

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (2799)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2869
                                                                                                                                                                                                Entropy (8bit):4.915914228886047
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:dhxoWLu4KJSjyXUtM4rO/FFmbIniSGBRWLuepThHox:d44CSjyfKOrOdSyUT6x
                                                                                                                                                                                                MD5:813895EF7C968C2E4B26339AB9C5AB93
                                                                                                                                                                                                SHA1:EE9B6ACCB3C62F847490044C60909374EC002EE8
                                                                                                                                                                                                SHA-256:C7C7F257DFAD7878ED137AF96B32A543ADA83D927E69F56B37B8EF4E7342F904
                                                                                                                                                                                                SHA-512:CDB5F52B281C7C07A4E1B8CFFD49D1B08BFB9F2590C31AACE47ED4D4ECEDB850F32F602A5AC3891488355E39BCDDA70650D304FB0808E98C35F66A3132447BD6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/events/1/9a79d70f-85b2-4e0d-986e-5df43330e7f9.{"ping_info":{"seq":1,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:34+01:00","reason":"startup","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"94e496bf-3c7e-4db9-9bf8-122f99be3ca5","os":"Windows","app_build":"20230927232528","app_display_version":"118.0.1","app_channel":"release","os_version":"10.0","architecture"

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\a1eef2b7-1be1-45c9-93ee-1bdd03805783

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1538)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1618
                                                                                                                                                                                                Entropy (8bit):5.092227746684785
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:BGIuT/C+JZiXG8+JwJgw+RhvRWSj+/WLX+ghXUPrGjMLAUmG7QkHaKLjNF9TSXKS:1QR8VOH4Sa/WLu4XUPKlLETa+ZTWv7qk
                                                                                                                                                                                                MD5:7974047AD6CB398367CF4AAA790B80B7
                                                                                                                                                                                                SHA1:D2B2045A0C382608C92587F98BD72FB1EA55A433
                                                                                                                                                                                                SHA-256:5459CACFEB4695FA524909E7B8C287CF336ECC5CDFCAC1F29F2923E17562A1D9
                                                                                                                                                                                                SHA-512:AB9C5B10C5BBD3AB0B460E33985B28D69961CBE86BD652C281AC57E8C8610CE99AB0A8F32CA8D1A40AF345F77B4F9704814C50B9DEA931228E2F12B61EFDA3D3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/a1eef2b7-1be1-45c9-93ee-1bdd03805783.{"ping_info":{"seq":10,"start_time":"2023-10-05T08:20+02:00","end_time":"2024-02-16T00:35+01:00","experiments":{"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","type":"nimbus-nimbus"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"b1d75314-5ef2-444b-9c96-b353ce28dd7c","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","build_date":"1970-01-01T00:00:0

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\ce258073-abaa-4281-aebf-03728e033789

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1538)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1618
                                                                                                                                                                                                Entropy (8bit):5.094771694530805
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:rbQHSaoYyDWLu4XUn7tgDHaZ+TWv7qVbD:0S9Yy34GU6Z+TWv+VbD
                                                                                                                                                                                                MD5:B0F673B6E37FD1D07310A1A467F81A69
                                                                                                                                                                                                SHA1:55E2C206EFA57016D162F459410C40B37C96C056
                                                                                                                                                                                                SHA-256:42A74A0A68D6850D55DE3C3063BC9C884B84745F1C98A7CC7517FA53F31C04B8
                                                                                                                                                                                                SHA-512:3C38E30CA44541842BBD590F267A0DEBF513A63DB99AF6EAF3FECA394357F82573EA8BC3AEBF6D416DE0C201A1DA7C45825FB13A9D05E589E80E5BD705BE675F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/ce258073-abaa-4281-aebf-03728e033789.{"ping_info":{"seq":11,"start_time":"2024-02-16T00:35+01:00","end_time":"2024-02-16T00:35+01:00","experiments":{"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"d4ca3def-aec5-42b2-b1e3-559d67fe58b7","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"b1d75314-5ef2-444b-9c96-b353ce28dd7c","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"treatment-a","extra":{"type":"nimbus-nimbus","enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"cff18e4e-a3e2-450c-a28f-e1824d155e26","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"e448ac36-35a1-421b-a6e6-dad58fb3f779"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","first_run_date":"2023-10-05+02:

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\session-state.json

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):161
                                                                                                                                                                                                Entropy (8bit):4.876855118137514
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YWAqKsbC9mEOJ3xMfA0DI0AqTyJ1xJA2aqnLJrja/H5C:YWAqfG4EmKfrDIsyJzOanLFu/ZC
                                                                                                                                                                                                MD5:C53E5D2A9741C7C195B3A5311F4FE3D5
                                                                                                                                                                                                SHA1:10E20F7DB93792A015C98F069E7E730B94635F32
                                                                                                                                                                                                SHA-256:C549A0B32A013BFC6437A76FBDF4312A7CE2CB737C3EAD52E231786EE55FF951
                                                                                                                                                                                                SHA-512:CD853B78A391D2F8027A30F39F0C30BFE9C421D0EAE3173DE4F1AED5C6E7917EDEF26CA296873CC9C4D2C27DC4DFF22C547FB4AF99537EA37628FF0D5E98E670
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"sessionId":"27c461b9-6986-4f7b-a210-48ff637c80d7","subsessionId":"83ff8581-027e-4750-8df1-0b2857efe6b5","profileSubsessionCounter":3,"newProfilePingSent":true}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):36830
                                                                                                                                                                                                Entropy (8bit):5.185052013683835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
                                                                                                                                                                                                MD5:10E2D85FEF0DB266E519048D63617FA8
                                                                                                                                                                                                SHA1:EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
                                                                                                                                                                                                SHA-256:92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
                                                                                                                                                                                                SHA-512:164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):36830
                                                                                                                                                                                                Entropy (8bit):5.185052013683835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
                                                                                                                                                                                                MD5:10E2D85FEF0DB266E519048D63617FA8
                                                                                                                                                                                                SHA1:EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
                                                                                                                                                                                                SHA-256:92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
                                                                                                                                                                                                SHA-512:164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1102240
                                                                                                                                                                                                Entropy (8bit):6.6236318014412126
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
                                                                                                                                                                                                MD5:842039753BF41FA5E11B3A1383061A87
                                                                                                                                                                                                SHA1:3E8FE1D7B3AD866B06DCA6C7EF1E3C50C406E153
                                                                                                                                                                                                SHA-256:D88DD3BFC4A558BB943F3CAA2E376DA3942E48A7948763BF9A38F707C2CD0C1C
                                                                                                                                                                                                SHA-512:D3320F7AC46327B7B974E74320C4D853E569061CB89CA849CD5D1706330ACA629ABEB4A16435C541900D839F46FF72DFDE04128C450F3E1EE63C025470C19157
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V..V7.V7.V7.9S.C7.9S.[7.9S..7.9S.U7.V7.17.._._7.._.b7.._.H7.V7.87.?_.W7.?_.W7.RichV7.........PE..d.....Jd.........." .................C....................................................`.........................................P7..,...|8..(................I.......)..............T...................`...(...`................................................text.............................. ..`.rodata............................. ..`.rdata..F...........................@..@.data...p3...P.......2..............@....pdata...I.......J...N..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1102240
                                                                                                                                                                                                Entropy (8bit):6.6236318014412126
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
                                                                                                                                                                                                MD5:842039753BF41FA5E11B3A1383061A87
                                                                                                                                                                                                SHA1:3E8FE1D7B3AD866B06DCA6C7EF1E3C50C406E153
                                                                                                                                                                                                SHA-256:D88DD3BFC4A558BB943F3CAA2E376DA3942E48A7948763BF9A38F707C2CD0C1C
                                                                                                                                                                                                SHA-512:D3320F7AC46327B7B974E74320C4D853E569061CB89CA849CD5D1706330ACA629ABEB4A16435C541900D839F46FF72DFDE04128C450F3E1EE63C025470C19157
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V..V7.V7.V7.9S.C7.9S.[7.9S..7.9S.U7.V7.17.._._7.._.b7.._.H7.V7.87.?_.W7.?_.W7.RichV7.........PE..d.....Jd.........." .................C....................................................`.........................................P7..,...|8..(................I.......)..............T...................`...(...`................................................text.............................. ..`.rodata............................. ..`.rdata..F...........................@..@.data...p3...P.......2..............@....pdata...I.......J...N..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                Entropy (8bit):4.920722044218877
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:C3OuN9RAM7VDXcEzq+r2Xl3vTMBv+FdBAIABv+FEn:0BDUm213vAWeWEn
                                                                                                                                                                                                MD5:2A461E9EB87FD1955CEA740A3444EE7A
                                                                                                                                                                                                SHA1:B10755914C713F5A4677494DBE8A686ED458C3C5
                                                                                                                                                                                                SHA-256:4107F76BA1D9424555F4E8EA0ACEF69357DFFF89DFA5F0EC72AA4F2D489B17BC
                                                                                                                                                                                                SHA-512:34F73F7BF69D7674907F190F257516E3956F825E35A2F03D58201A5A630310B45DF393F2B39669F9369D1AC990505A4B6849A0D34E8C136E1402143B6CEDF2D3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 2.3.2.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                Entropy (8bit):4.920722044218877
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:C3OuN9RAM7VDXcEzq+r2Xl3vTMBv+FdBAIABv+FEn:0BDUm213vAWeWEn
                                                                                                                                                                                                MD5:2A461E9EB87FD1955CEA740A3444EE7A
                                                                                                                                                                                                SHA1:B10755914C713F5A4677494DBE8A686ED458C3C5
                                                                                                                                                                                                SHA-256:4107F76BA1D9424555F4E8EA0ACEF69357DFFF89DFA5F0EC72AA4F2D489B17BC
                                                                                                                                                                                                SHA-512:34F73F7BF69D7674907F190F257516E3956F825E35A2F03D58201A5A630310B45DF393F2B39669F9369D1AC990505A4B6849A0D34E8C136E1402143B6CEDF2D3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 2.3.2.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                Entropy (8bit):0.08216124244691245
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:DBl/WP7Wla0mwPxRymgObsCVR45wcYR4fmnsCVR49v7LEKUguGBgf:DL+dsh7Owd4+oXUAB
                                                                                                                                                                                                MD5:4054D06E6BBBD944DB886B969EB8BC1F
                                                                                                                                                                                                SHA1:C12550D49C62386EFA443C1EF68545540AE7702D
                                                                                                                                                                                                SHA-256:505B751BCC8334C2D9C92224CB2EB22F0B368C210A75F089532C64074D4C140B
                                                                                                                                                                                                SHA-512:78DD7DC3D9A019691FD4B2D744AEF3CE29B8E53804C9E90BDFA0536FE95113DC809A0FDAE99B7D2902B5D922051CE88829CEF83564CBACD95AA02166513E4934
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite-journal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):66064
                                                                                                                                                                                                Entropy (8bit):0.11111102205378207
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:7+t3eguGBgftWW6Bl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4K:7+t3eAB0WW6Lhesh7Owd4+B
                                                                                                                                                                                                MD5:E00849286D91C3A235DD9351C75B1CAF
                                                                                                                                                                                                SHA1:40EC4E3C67E8A6B2AF00516FD6F11D7ECE7B400D
                                                                                                                                                                                                SHA-256:8045CE52D59200659D19DCC6A72185CDF12C9A7F80E1348401BB4BC934161560
                                                                                                                                                                                                SHA-512:2C10B85BDBB038F0276997D615CC03A53E13550F67CC3281986744201EC43E56CD0F13F002057FB8B2131019264630E3D87A14623092BA568CC587CBB415B4CB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... .c.....v...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                Entropy (8bit):0.046110770350477566
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:58r54w0VW3xWHZ5B2o4vD1hUHAm0udFZ3gD:uqVW3o54gp7Zw
                                                                                                                                                                                                MD5:4D6534FD82EFB1CEB3E3C82E47B769F9
                                                                                                                                                                                                SHA1:506A963F09C35E4C48617FD01096647A9C38B674
                                                                                                                                                                                                SHA-256:9804750BDCB23C37C0D5C785B42161CBA9CC8ED7A40FD233E45D3AE3A8BD32C8
                                                                                                                                                                                                SHA-512:6265AB6804F17468BED70BC4186D0D4E63F65579589D846D060F534A4676BE52C97DBB5142A7566BE9921173511D9569DA83297F94A77F742A62802592990CD9
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.036924417396215485
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:GhlvVauUc02WURjONlY5lvVauUc02WURjON/D89//nltll:Ghibr2RMNlUibr2RMN/D89X
                                                                                                                                                                                                MD5:92FF5AFC5EB0FF2A381B359E7A4ADAA1
                                                                                                                                                                                                SHA1:D5A8E7BA9B2E31A48824A446CF46DD5495F6D720
                                                                                                                                                                                                SHA-256:D13A6B6B90F772EAB56336B27196D5D6E7064557EBAC2E0A90863163DFE81A44
                                                                                                                                                                                                SHA-512:F97E01D9B24B77AC9508CED7F3AE3B84C6C1F8AB3F86667DA50589907C0A2690704CB13EC2A6BC51E0C8B09C86D371DD35C8358FB99883F0C86B10D3819EC3C8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.......................=R1y>5&.o.....nB...gh..-.......................=R1y>5&.o.....nB...gh........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2328264
                                                                                                                                                                                                Entropy (8bit):0.15447692091547613
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:mc9YwL1CW2w33f4gTggq+IDOuOrc4gFAD5:5qwBJ3vTfmyuh6N
                                                                                                                                                                                                MD5:B7424C49F33A9B6094E94FD31833751F
                                                                                                                                                                                                SHA1:C5B487827D7C67F09807AD2937C2DE79A7C287C3
                                                                                                                                                                                                SHA-256:700FCA7D98A6885C330D47301BDBB530042619F0113DCD2B98312A7754F6951F
                                                                                                                                                                                                SHA-512:CC1A4B11B460538A6B81AB11AB31F747ED9B900304A2508020374A1687281EFA47BE29877EFDD68150AAB26CD3677D4D460E533EE44F23C0DE698AFE6DB79B36
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:7....-..........&.o.....7.9.tco........&.o.....d.....K].yW..s....~.~.~c}Ix:|mz.s.x.x.w.u...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1717), with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):17240
                                                                                                                                                                                                Entropy (8bit):5.424071341554555
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:h5nTFTRRUE/hbBp6LLZNMGaX2m+qU4XPzy+/3/78Gs5RYiNBw8dRH2y5sSl:TKciFNMiwryCSdwL0
                                                                                                                                                                                                MD5:FB210A5FD85D0E87385FE70B9B95BD9D
                                                                                                                                                                                                SHA1:0A9237528AFC87BD3F8004829ACE0FBCC29E4605
                                                                                                                                                                                                SHA-256:9ED1B026394961514176BA05DE6E23D1BFC05BE624EFD2F2E1F2FDC71071C7A5
                                                                                                                                                                                                SHA-512:DD1B41AEA206ECB537C0F6AAAC6DC00B1D6CBB58CD82EDB77EF4C58199ADA90901E117D4D8CB570F2FB00E3C58559EA5C4C614EFF5EABCB1B760E1E42B322B71
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1708040077);..user_pref("app.update.lastUpdateTime.background-update-timer", 1708040077);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1708040077);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.r

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1717), with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):17240
                                                                                                                                                                                                Entropy (8bit):5.424071341554555
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:h5nTFTRRUE/hbBp6LLZNMGaX2m+qU4XPzy+/3/78Gs5RYiNBw8dRH2y5sSl:TKciFNMiwryCSdwL0
                                                                                                                                                                                                MD5:FB210A5FD85D0E87385FE70B9B95BD9D
                                                                                                                                                                                                SHA1:0A9237528AFC87BD3F8004829ACE0FBCC29E4605
                                                                                                                                                                                                SHA-256:9ED1B026394961514176BA05DE6E23D1BFC05BE624EFD2F2E1F2FDC71071C7A5
                                                                                                                                                                                                SHA-512:DD1B41AEA206ECB537C0F6AAAC6DC00B1D6CBB58CD82EDB77EF4C58199ADA90901E117D4D8CB570F2FB00E3C58559EA5C4C614EFF5EABCB1B760E1E42B322B71
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1708040077);..user_pref("app.update.lastUpdateTime.background-update-timer", 1708040077);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1708040077);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.r

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):65536
                                                                                                                                                                                                Entropy (8bit):0.04062825861060003
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
                                                                                                                                                                                                MD5:60C09456D6362C6FBED48C69AA342C3C
                                                                                                                                                                                                SHA1:58B6E22DAA48C75958B429F662DEC1C011AE74D3
                                                                                                                                                                                                SHA-256:FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
                                                                                                                                                                                                SHA-512:936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite-journal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):33288
                                                                                                                                                                                                Entropy (8bit):0.08338195131242726
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:7+/l9gtBl/lquN1P4BEJYqWvLue3FMOrMZ07:7+t96Bl/ZnjfJiFxMZA
                                                                                                                                                                                                MD5:B9589E6D3BEFF4CE5D5D73E25B8003DA
                                                                                                                                                                                                SHA1:BE264068E183A354EA83FF48082C7FF60EB75853
                                                                                                                                                                                                SHA-256:6ADEBD9F86EA493615799B854BCF01FA202EBA5CD9C69D83CEB82CBD11C50446
                                                                                                                                                                                                SHA-512:D574986D138A0CA1BFCB44C357CB6B5A2DF5BF7B9BB8FB443C07422E43EBEA7623BEFE6D637EB2054E15D96F61E108BA270E40673DB95810DDE114076354573D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... .c......-.7....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.......x..x......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):90
                                                                                                                                                                                                Entropy (8bit):4.194538242412464
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):90
                                                                                                                                                                                                Entropy (8bit):4.194538242412464
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 9498 bytes
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2369
                                                                                                                                                                                                Entropy (8bit):6.61584406699709
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:FprWoK3/eTZSgJGkhC5RLMgXNiRd7mGAEjXwi/6qnG2oRhJsH:DKvKDJDkzMgdiHKGTDpnMhGH
                                                                                                                                                                                                MD5:9A228408F27D12B8B8E2DAA8D66E3632
                                                                                                                                                                                                SHA1:7828DD845D327E32D3E0CA0DB0000201A9FEB0C6
                                                                                                                                                                                                SHA-256:6E258BBB7589F24BFD611461940E34C8D0A8583F91F12AE320E6FEE887947BC6
                                                                                                                                                                                                SHA-512:2AEDDF7DFA3C97E353D37A186BDB566B34F146F696DC9571CD8C0A2A85897E2A4433D2F08991034212F0BEE335D1FAACDE7F845EDC1EE07A5BD5E3C684135B0A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40..%....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/","title#....cacheKey":0,"ID":4,"docshellUU...D"{e2bd5f84-5ef9-4842-ac16-2b72fd26230e}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..+docIdentifier":5,"persist":true}],"lastAccessed":170804005..v,"hiddey..searchMode...userContextId...attributq..{},"index":1...questedI..p0,"imagn...chrome://global/skin/icons/warning.svg"},....accounts.googl..pv3/signN.....?continue=...%3A%2F%2F@...%2F&followup....ifkv=ATuJsjwzyxcB0EB4wZo7BvtnAGjiNDuvz5_J0A9jHm7rUMVPpyf9puZf6eTSmOpLcjt5hb7pHATmFw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1091390242%3A....35675965753&theme=glif........W..".6..5...6...48763f0f-db9e-46a8-a4e5-4e335ba6cc00....referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ....ABAA==","origin...$..........4...3..!.loadReplace......2.....`entTypK...../html","pX..ToInherit(..0(....`\"moz-z..4...:{b1187c2a-4ba1-4741-9

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 9498 bytes
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2369
                                                                                                                                                                                                Entropy (8bit):6.61584406699709
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:FprWoK3/eTZSgJGkhC5RLMgXNiRd7mGAEjXwi/6qnG2oRhJsH:DKvKDJDkzMgdiHKGTDpnMhGH
                                                                                                                                                                                                MD5:9A228408F27D12B8B8E2DAA8D66E3632
                                                                                                                                                                                                SHA1:7828DD845D327E32D3E0CA0DB0000201A9FEB0C6
                                                                                                                                                                                                SHA-256:6E258BBB7589F24BFD611461940E34C8D0A8583F91F12AE320E6FEE887947BC6
                                                                                                                                                                                                SHA-512:2AEDDF7DFA3C97E353D37A186BDB566B34F146F696DC9571CD8C0A2A85897E2A4433D2F08991034212F0BEE335D1FAACDE7F845EDC1EE07A5BD5E3C684135B0A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40..%....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/","title#....cacheKey":0,"ID":4,"docshellUU...D"{e2bd5f84-5ef9-4842-ac16-2b72fd26230e}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..+docIdentifier":5,"persist":true}],"lastAccessed":170804005..v,"hiddey..searchMode...userContextId...attributq..{},"index":1...questedI..p0,"imagn...chrome://global/skin/icons/warning.svg"},....accounts.googl..pv3/signN.....?continue=...%3A%2F%2F@...%2F&followup....ifkv=ATuJsjwzyxcB0EB4wZo7BvtnAGjiNDuvz5_J0A9jHm7rUMVPpyf9puZf6eTSmOpLcjt5hb7pHATmFw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1091390242%3A....35675965753&theme=glif........W..".6..5...6...48763f0f-db9e-46a8-a4e5-4e335ba6cc00....referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ....ABAA==","origin...$..........4...3..!.loadReplace......2.....`entTypK...../html","pX..ToInherit(..0(....`\"moz-z..4...:{b1187c2a-4ba1-4741-9

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 9498 bytes
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):2369
                                                                                                                                                                                                Entropy (8bit):6.61584406699709
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:FprWoK3/eTZSgJGkhC5RLMgXNiRd7mGAEjXwi/6qnG2oRhJsH:DKvKDJDkzMgdiHKGTDpnMhGH
                                                                                                                                                                                                MD5:9A228408F27D12B8B8E2DAA8D66E3632
                                                                                                                                                                                                SHA1:7828DD845D327E32D3E0CA0DB0000201A9FEB0C6
                                                                                                                                                                                                SHA-256:6E258BBB7589F24BFD611461940E34C8D0A8583F91F12AE320E6FEE887947BC6
                                                                                                                                                                                                SHA-512:2AEDDF7DFA3C97E353D37A186BDB566B34F146F696DC9571CD8C0A2A85897E2A4433D2F08991034212F0BEE335D1FAACDE7F845EDC1EE07A5BD5E3C684135B0A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:mozLz40..%....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/","title#....cacheKey":0,"ID":4,"docshellUU...D"{e2bd5f84-5ef9-4842-ac16-2b72fd26230e}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..+docIdentifier":5,"persist":true}],"lastAccessed":170804005..v,"hiddey..searchMode...userContextId...attributq..{},"index":1...questedI..p0,"imagn...chrome://global/skin/icons/warning.svg"},....accounts.googl..pv3/signN.....?continue=...%3A%2F%2F@...%2F&followup....ifkv=ATuJsjwzyxcB0EB4wZo7BvtnAGjiNDuvz5_J0A9jHm7rUMVPpyf9puZf6eTSmOpLcjt5hb7pHATmFw&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1091390242%3A....35675965753&theme=glif........W..".6..5...6...48763f0f-db9e-46a8-a4e5-4e335ba6cc00....referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ....ABAA==","origin...$..........4...3..!.loadReplace......2.....`entTypK...../html","pX..ToInherit(..0(....`\"moz-z..4...:{b1187c2a-4ba1-4741-9

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\data.safe.bin (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Matlab v4 mat-file (little endian) chistory, text, rows 0, columns 2817
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):152
                                                                                                                                                                                                Entropy (8bit):4.313459770306586
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:klJFc/slbKRxrtsLVWDWkl1RlQRM9WREaD3EWncuWsgfeYY:szcxhPlVQsWiA3fcuyHY
                                                                                                                                                                                                MD5:468ECB977EAC81504E68B544FE21B1F4
                                                                                                                                                                                                SHA1:9C207D7DD6034E9ADE7017782924916D24F11E4F
                                                                                                                                                                                                SHA-256:853EF4E3BB60C5C1DA7C46795700F2B0BFF62BD85DB9046CBDC6AAF13061715D
                                                                                                                                                                                                SHA-512:15E35F69FFB937BC703BD0B372FA7F0EAA12ACD5E3B40C003CC0953A047DB70EC1BE8008B8F64C4F9085B4DA5BF55909B84FA5BE12B3F184D2E47512146F8815
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.................synchistory....................v1-settings-sync.1708032635406B........9.......{"timestamp":1708032635406,"status":"success","infos":{}}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\data.safe.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:Matlab v4 mat-file (little endian) chistory, text, rows 0, columns 2817
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):152
                                                                                                                                                                                                Entropy (8bit):4.313459770306586
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:klJFc/slbKRxrtsLVWDWkl1RlQRM9WREaD3EWncuWsgfeYY:szcxhPlVQsWiA3fcuyHY
                                                                                                                                                                                                MD5:468ECB977EAC81504E68B544FE21B1F4
                                                                                                                                                                                                SHA1:9C207D7DD6034E9ADE7017782924916D24F11E4F
                                                                                                                                                                                                SHA-256:853EF4E3BB60C5C1DA7C46795700F2B0BFF62BD85DB9046CBDC6AAF13061715D
                                                                                                                                                                                                SHA-512:15E35F69FFB937BC703BD0B372FA7F0EAA12ACD5E3B40C003CC0953A047DB70EC1BE8008B8F64C4F9085B4DA5BF55909B84FA5BE12B3F184D2E47512146F8815
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.................synchistory....................v1-settings-sync.1708032635406B........9.......{"timestamp":1708032635406,"status":"success","infos":{}}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4096
                                                                                                                                                                                                Entropy (8bit):2.042811512334329
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
                                                                                                                                                                                                MD5:21235938025E2102017AC8C9748948A4
                                                                                                                                                                                                SHA1:A1EED1C4588724A8396C95FC9923C0A33B360FF8
                                                                                                                                                                                                SHA-256:E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
                                                                                                                                                                                                SHA-512:D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite-journal

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2072
                                                                                                                                                                                                Entropy (8bit):0.40377968245407186
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:7FEG2l8pc/tllndlp/FlE/ljvX/lE/lk20pMRgSEBtl/StlVltllJWXXJcEn:7+/lXtx/UjSngvBtlq2HJcE
                                                                                                                                                                                                MD5:BA8294D46D7EC281554FBA3A64F6A3D1
                                                                                                                                                                                                SHA1:F81105CEF68F7ADBAEB34A27B70F5B478F8EF62E
                                                                                                                                                                                                SHA-256:44D6D340E6D979A58373651BCFA1232696C6702133226B9A2D23CFB2BE65DD08
                                                                                                                                                                                                SHA-512:EAC28AC919B7EF2DA796E4A57641C3C98E81FBE53E4ED5A7607C1568D9A8364EDD00B318F983F1C8788A96795701361D575C61010561253416A87D9783511B03
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... .c......U.`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.02060845394601122
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:G8l6etAiml6etAhR9//:G0ztezt09X
                                                                                                                                                                                                MD5:FA6B0FAA7AF8D9C1BBE57688AE760E8A
                                                                                                                                                                                                SHA1:F9A807A9CAFAF3EDC728DC11A62972537776F0AD
                                                                                                                                                                                                SHA-256:332043929F57772381FC1A764F9DC19FBA4C6C1062F9473B396D375F54A61561
                                                                                                                                                                                                SHA-512:DEBAF4B2234DD401F2DA758AF731E39473D9AD87F94FFD86D978D66D1BC2B320A0F8CAE7307A7427DAF2236D6550402BDA9AC04D910C59590309478D245AED15
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.................................6.}.8...kOY...-.................................6.}.8...kOY.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):828655
                                                                                                                                                                                                Entropy (8bit):7.998819316098926
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:24576:RU5+yypiAf3Q5sQ2rveB3Rd0fXj9i+BZqYqrW:g+yycAY5mrva3RdCjgY
                                                                                                                                                                                                MD5:0C40063DE91B8B8297F5398D04D72B22
                                                                                                                                                                                                SHA1:8355767BB03A3D894F5FD142F767518603ADB3C7
                                                                                                                                                                                                SHA-256:3CD2EE400A959DC53FD60776CBBE220AA752903B658B262788D2BE974F341FC8
                                                                                                                                                                                                SHA-512:34EEF7708B456E637706E6E79A5911EFBF1B747FE524DCEACE14F586EE09907CA2B893AFDD0855495014789ECB7805B252B22201BE91205E33227EA24AADC2CE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:......M.....f..W~)....,........Vs...U...!Vb...6....f...B.B...$h.v.x=..?..D.......;...........o y...*.w.(W#... _../.....u.`...Yq..u.."l.....E........h.M...'..xK.,<.O.....O.h...sy..(BX.[..M...q.......vc.4.L{..9>9..;.......$!..(....0h........s..?Y../Q.'E.,...V....pR...Fr...qs.....Q..T.kz-.........><..:..6r.....$.....(.....--...P.vK..&.d...xuJ6......2j..&oz..+PF<../...o...2=X......2....c.G..V<7.nt....O.!.{m;.}....LP...N|...U...3.).+.SW6G..l..B..u\...m-).9.r..j..nd_....h.*....kD.#.O.0.....;Z........{..4.g..;-+.w.=^..(.m.a/.w$...-....af&..........E~9...8/.....}...3K.2.[b....P.3.k.............N.rR.)..a.3...3./E..t..o..3>.....m.N...o...{..;.........B..~...W....S3..n(..|..Z...Nb.r";.iw.V.6=V..O.>g..k..^.....C=>5+.G..".37..Q.....l~.!...[8.X..+......}r.V._.o...PG.....V.2..._..\.8....e..m......o..&W&..THW.*P4+..........s)....4.....g.A.i........N..?3..{g.i..#.U.}.gL..........n..Gu.a.6.$X....b.n.{.4..9.....;=n..x.d.S:o.+.0.3.?&....V.....J..~.y....

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:SQLite 3.x database, user version 416, last written using SQLite version 3042000, writer version 2, read version 2, file counter 21, database pages 496, cookie 0xd, schema 4, largest root page 11, UTF-8, vacuum mode 1, version-valid-for 21
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2031616
                                                                                                                                                                                                Entropy (8bit):4.9220087440762805
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:q69dVzPVyNVZ9DPx7x9Oo5BP1fuYdpoWPNBKFJNvTIJMmJQPsCGU3Yl0hn0HBQgL:eBH
                                                                                                                                                                                                MD5:939FAD722BBF1BC6BDC732C3E39DC62C
                                                                                                                                                                                                SHA1:DCCA0866D162F9D9B092B418B1ED14D237C89D15
                                                                                                                                                                                                SHA-256:5E32FEDD4B93101B7EFED3CB22CBDFD47F9B223A6A32A95E68CB2A0FFBD61E2A
                                                                                                                                                                                                SHA-512:DE3A3523D8CDC87834EB467ABBFB662DAE71F1E62DADAB94554875097F3841806AC046CC6935751D69F61F87DBF39BAE13C887B64BAE957B3803B7A6FD4E9910
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j............;.......[..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-...3....triggerfile_update_triggerfileCREATE TRIGGER file_update_trigger AFTER UPDATE ON file FOR EACH ROW WHEN NEW.refcount = 0 BEGIN DELETE FROM file WHERE id = OLD.id; END.Y...A#..Ytriggerobject_data_delete

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                Entropy (8bit):0.05984011110280832
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:GbTvNlbTv29XhlHQOwk8t8y+DWsOnAT6kr:a/vSMOXpOn1k
                                                                                                                                                                                                MD5:729DBDD4B4D5E881564105D230DF9AF4
                                                                                                                                                                                                SHA1:8C0B8007ACA9E92DCC0C0C4B6F81A51D92882E40
                                                                                                                                                                                                SHA-256:5E75745E42FA32DB264A97326354200A1B51BCFF5B8F9CAFD6407917470EF441
                                                                                                                                                                                                SHA-512:3EC9C9FA784EAADAE7D3FD0BBF28059DE9B223BD497B4B1BF26E20188815CD73E2A75312BEFBE6773BE2E6F67BC9266704AF5EE8B1321DA10BBD79F7FBAB99B3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..-.........................'...#.......J....~{..-.........................'...#.......J....~{........................................B................... ...$...,.../...5...8.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):141
                                                                                                                                                                                                Entropy (8bit):4.527146700950922
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YGNDhK6c2us1pNGHfYS8dJsAulvhJBAuqRrHvN+M4fHlxKgfHwFn:YGNTG/SJsAUv54rH0vHlxKgfQFn
                                                                                                                                                                                                MD5:74E2B5FEA591C1050CAD4BED0AFE0EA1
                                                                                                                                                                                                SHA1:511B7F71B3F73354282145A5B5824BF13758F262
                                                                                                                                                                                                SHA-256:D59735F5C04F870A5E3E272CED57FCBA79E9EE309D228E6EF76D25057D902710
                                                                                                                                                                                                SHA-512:29DEED066A22EF405CBB4D01C1F11BDE3E94F019ED6CCC1C9DACEEA78C816C2454E73325B7CB4CB0AED219E27A4D71DA9A47ACBE7EA24B8C55DAE4AA983B155C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"chrome://browser/content/browser.xhtml":{"main-window":{"screenX":"4","screenY":"4","width":"1164","height":"891","sizemode":"maximized"}}}

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):141
                                                                                                                                                                                                Entropy (8bit):4.527146700950922
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:YGNDhK6c2us1pNGHfYS8dJsAulvhJBAuqRrHvN+M4fHlxKgfHwFn:YGNTG/SJsAUv54rH0vHlxKgfQFn
                                                                                                                                                                                                MD5:74E2B5FEA591C1050CAD4BED0AFE0EA1
                                                                                                                                                                                                SHA1:511B7F71B3F73354282145A5B5824BF13758F262
                                                                                                                                                                                                SHA-256:D59735F5C04F870A5E3E272CED57FCBA79E9EE309D228E6EF76D25057D902710
                                                                                                                                                                                                SHA-512:29DEED066A22EF405CBB4D01C1F11BDE3E94F019ED6CCC1C9DACEEA78C816C2454E73325B7CB4CB0AED219E27A4D71DA9A47ACBE7EA24B8C55DAE4AA983B155C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{"chrome://browser/content/browser.xhtml":{"main-window":{"screenX":"4","screenY":"4","width":"1164","height":"891","sizemode":"maximized"}}}

                                                                                                                                                                                                C:\Windows\SysWOW64\GroupPolicy\gpt.ini

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):11
                                                                                                                                                                                                Entropy (8bit):3.2776134368191165
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1EX:10
                                                                                                                                                                                                MD5:EC3584F3DB838942EC3669DB02DC908E
                                                                                                                                                                                                SHA1:8DCEB96874D5C6425EBB81BFEE587244C89416DA
                                                                                                                                                                                                SHA-256:77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
                                                                                                                                                                                                SHA-512:35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[General]..

                                                                                                                                                                                                C:\Windows\System32\GroupPolicy\GPT.INI

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):127
                                                                                                                                                                                                Entropy (8bit):5.080093624462795
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsUov:1WsMzYHxbnvEcvgqv
                                                                                                                                                                                                MD5:8EF9853D1881C5FE4D681BFB31282A01
                                                                                                                                                                                                SHA1:A05609065520E4B4E553784C566430AD9736F19F
                                                                                                                                                                                                SHA-256:9228F13D82C3DC96B957769F6081E5BAC53CFFCA4FFDE0BA1E102D9968F184A2
                                                                                                                                                                                                SHA-512:5DDEE931A08CFEA5BB9D1C36355D47155A24D617C2A11D08364FFC54E593064011DEE4FEA8AC5B67029CAB515D3071F0BA0422BB76AF492A3115272BA8FEB005
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=1..

                                                                                                                                                                                                C:\Windows\System32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                File Type:RAGE Package Format (RPF),
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1926
                                                                                                                                                                                                Entropy (8bit):3.310422749310586
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
                                                                                                                                                                                                MD5:CDFD60E717A44C2349B553E011958B85
                                                                                                                                                                                                SHA1:431136102A6FB52A00E416964D4C27089155F73B
                                                                                                                                                                                                SHA-256:0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
                                                                                                                                                                                                SHA-512:DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

                                                                                                                                                                                                Chrome Cache Entry: 1000

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                Entropy (8bit):4.923041841279974
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHaxhTIQfaaiBFbCcD8o+fmQGq18i:tI9mc4slhohC/vmI4OhEQfR6Fb3Y1OQV
                                                                                                                                                                                                MD5:D6F15B1444CE6B4DBC711AC9E9041F17
                                                                                                                                                                                                SHA1:98D8A4EAB8E132C5894592992F532CF36D71810D
                                                                                                                                                                                                SHA-256:2BE645A9C201E31B43E28FD5541E36B73175D503362ACBA96CF578B95DB8DD8A
                                                                                                                                                                                                SHA-512:89F41624C92CB68B716287E74ADD7DEEF7BD67E8FB68BBF7DF93BB84AE1478248CDFC35C26F45A0A6DE347808E9E6431CA771EC9A18E0FF6869843D66B2B4E77
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/download/v9/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 18v2H6v-2h12zm-.6-6.3L16 10.3l-3 2.9V4h-2v9.2l-3-2.9-1.4 1.4 5.4 5.4 5.4-5.4z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1001

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (607)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):34096
                                                                                                                                                                                                Entropy (8bit):5.377197980146912
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:z8VEGqVW3bOg+mfQ1ZPiWMKO5oXpmdVMmGX9CJ/:z8ViV4H99PV
                                                                                                                                                                                                MD5:D34FA1A4E706D1903D672FBEFD77C123
                                                                                                                                                                                                SHA1:8557C2FCCF139E973C184A9158B87D8705F9C270
                                                                                                                                                                                                SHA-256:EBB28D49644D82C01EE501157C4324C32F646E8E382C94334F3F878F8B99A7B2
                                                                                                                                                                                                SHA-512:9562E79B5A11A3402937143A401E724CC35F6942CDC91F764490C162167C01280C87E6E505EED9366FA8E097D6CAB801ECBA4FBF7B8F5F707ED3BC7BCD55D3DB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/endscreen.js
                                                                                                                                                                                                Preview:(function(g){var window=this;'use strict';var Prb=function(a,b){a.kb("onAutonavCoundownStarted",b)},l6=function(a,b,c){g.bv(a.element,"ytp-suggestion-set",!!b.videoId);.var d=b.playlistId;c=b.gh(c?c:"mqdefault.jpg");var e=null,f=null;b instanceof g.SS&&(b.lengthText?(e=b.lengthText||null,f=b.nw||null):b.lengthSeconds&&(e=g.eH(b.lengthSeconds),f=g.eH(b.lengthSeconds,!0)));var h=!!d;d=h&&"RD"===g.FRa(d).type;var l=b instanceof g.SS?b.isLivePlayback:null,m=b instanceof g.SS?b.isUpcoming:null,n=b.author,p=b.shortViewCount,q=b.publishedTimeText,r=[],t=[];n&&r.push(n);p&&(r.push(p),t.push(p));q&&t.push(q);c={title:b.title,author:n,author_and_views:r.join(" \u2022 "),aria_label:b.ariaLabel||.g.nK("Watch $TITLE",{TITLE:b.title}),duration:e,timestamp:f,url:b.Tk(),is_live:l,is_upcoming:m,is_list:h,is_mix:d,background:c?"background-image: url("+c+")":"",views_and_publish_time:t.join(" \u2022 "),autoplayAlternativeHeader:b.qs};b instanceof g.RS&&(c.playlist_length=b.playlistLength);a.update(c)},m6

                                                                                                                                                                                                Chrome Cache Entry: 1002

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):363
                                                                                                                                                                                                Entropy (8bit):4.49126552549198
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4CCUljullQ5dUiC7KITuMUxldUiiiC1ofuMUxldUiiiC17:t47N9U/vmRXKjullQ5d+puMUxldbfuMh
                                                                                                                                                                                                MD5:82A60FADA6F7957329BEEE85E0453CAF
                                                                                                                                                                                                SHA1:6882C6B5F04787D57F3B59C1D1559623BC40E146
                                                                                                                                                                                                SHA-256:98901DDFF67E245769A3E1F47ABA0210653F817436CE288646FC0BB88E859CFA
                                                                                                                                                                                                SHA-512:646BE4874078FB5B9072DF552DA8CF0A1E5533D1B65392E06008676D8B06CA3E5EAFAC14C89BB580E0A7EAAEE94B3EC0825174328C3B30FC92D66730FBAD373F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/overflow_vertical/v10/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 16.5c.83 0 1.5.67 1.5 1.5s-.67 1.5-1.5 1.5-1.5-.67-1.5-1.5.67-1.5 1.5-1.5zM10.5 12c0 .83.67 1.5 1.5 1.5s1.5-.67 1.5-1.5-.67-1.5-1.5-1.5-1.5.67-1.5 1.5zm0-6c0 .83.67 1.5 1.5 1.5s1.5-.67 1.5-1.5-.67-1.5-1.5-1.5-1.5.67-1.5 1.5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1003

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):13351
                                                                                                                                                                                                Entropy (8bit):7.951639551771462
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:PZxP6fSVUrfkIuYsL5U2EsSf5jvAF8v4wiolC0ZiKH:PZtJUkYUMsSf5jALxg9
                                                                                                                                                                                                MD5:CB2C049048D09B57A65A8DE1E66F5933
                                                                                                                                                                                                SHA1:B398EF1076168A33157A0D40DFABC7F5AAA0CD32
                                                                                                                                                                                                SHA-256:E46CB14FE6FC7B29D37008E711A2A15C24DC2D8655F8EB4D95C2C55D6B002EB1
                                                                                                                                                                                                SHA-512:0D92CE2D66AF7806342109D1C141614FF2CBDE8565EC3502CE60F13F73751A9687A6D9FF8BD463B34FA4055D3CF4ABB8FFC69344FBF25E01326403B9E578C728
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t51.29350-10/427329750_1596577751113632_5947837655335878143_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=DAGwYKUDfUAAX_JHsCO&_nc_ht=scontent-lga3-2.xx&oh=00_AfDK-6amkOv7wJdPMsbuuq9-8ZkEa_LNtbIXJBkbvoCncQ&oe=65D4291B
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000eb050000c20c0000790d00004c0e000063140000fc1e00000e200000192100004d22000027340000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................u..A.PHR.d;&.2.HL..!..d.+10...2..*.. A.p.PHZ.......fiI....D.>....<h.....f`.......PL($*.....Y^7.G...z7.C@. p...I.........".(..x...7Cx.F....2.....B...$)3...Y..Y;..L.LP........Y.Gb.Z.(.j4....h.D.k.K......g....z.y:OY/&j..t69v.+vU9..v<}z|...y....{...ho.....U'......\...>..R.@.$..d.......;..... p..).."..W.$.; ..*.g2.Ms3.h$...E..xf=...*$.$....:..B....J..c. Y.. 7\W......5yv}\.]Y.oO..o../.M.l.m.........]......P.4)t.zD.....y./.....n..n,C%..:.."...:d.1.=.....c.c...SJ.F..I..(U5*..........Z.d.....!!.........4..../wF2w..w...%...5..+.cJ...t....6kLSw..5e....}\x3.....v.e.....9u..,..e...Z..vV.^

                                                                                                                                                                                                Chrome Cache Entry: 1004

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):11491
                                                                                                                                                                                                Entropy (8bit):7.921921360775901
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:+5njd+I3/Q37NU4CSH027eQmqNh+2wiWwlMrxnJZCvQ0IdBZ+:Wnjd/3kMigQJ7+2wiWw2rP8vpIA
                                                                                                                                                                                                MD5:751445AC4F5A65EDFF6B6C117EA2C3B1
                                                                                                                                                                                                SHA1:C7852B04DF4A5427BF05FA082660FD3F11524425
                                                                                                                                                                                                SHA-256:3628A69504E4C442AA93663BB5DDD3EA4C8787AB227BEB656E510E9A038F12F4
                                                                                                                                                                                                SHA-512:D2C2ECE1ED95EC1FAFB39581FA8AE59C6CBE794581DB04FCDF529779F5B3663B98F52F8A6D700B075BEF579423E52D6778876226ABA2DA40C1742C1B9E729217
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426581654_956884026045005_1106730845085276488_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=R3AoH01rzlkAX_gBn4n&_nc_ht=scontent-lga3-2.xx&oh=00_AfA9MSJn4YNBRrlAAWINWN-ndKqyphHVe-mxz9iAppJ7SQ&oe=65D44B36
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000ae050000880b0000660c0000280d000032130000c91b0000db1c0000d11d0000b01e0000e32c0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................]b..UA.!..G...4pI...n..j8...pL..EU.*..CG.Q...G.G .A......XQ. .4..]9..:t9..E...9....N..a4(.G.....C7o.......Q6...S....2...Q..i-...l-.S.f}.q..j6...|.g;IV^.I..qz.dkD.:..V...M.^:.&.r%.t..4....K.N%.V.c..uW........X.c.A......l9..~....o..X.:..w-.X.....\.$B$..O....K*D.1....7:.[...t.S]'c/6.>..~G...,..y..PPFL...K.yX.i:.K.X.r&..C..y..4o.\....:\}x...u.....ym...c.T)Ab......t.X..........^...k.y.R.^m.....kR...wq.....c_6.....F4.R.#.....7...W.;~F..#...._.r.M7+;.t9.!...{..`....o../os...&Wm6..<....;.D..q.='-...PM....Z..y.{9$Gz<...k..gO,........-.........N..0.<...?......7....#.........n..h./.j

                                                                                                                                                                                                Chrome Cache Entry: 1005

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                Entropy (8bit):5.0971144323973805
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHeQR+Hmy7NdURsoDCb:tI9mc4slhLJ9hC/vm+Qqmy7NdcE
                                                                                                                                                                                                MD5:FE331A9DBB967C0CF9B8F9393194706D
                                                                                                                                                                                                SHA1:AD46D5C48638D094B7CB6065748F2F0DC13379D3
                                                                                                                                                                                                SHA-256:7BB86F0FED70C3026F3D41D1ED0ADC304A4EBA489901226658C65A9244A4E22A
                                                                                                                                                                                                SHA-512:E67196D4A808B2E82EBEFD6922A5822F9FC11C9F030B7E0C75D079A700339D1D0300B12DADEA7DFF9833BB27FCCFA1C4E026783091484FD6E6F7B1078251D057
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/flag/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L14 3z"/></g></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1006

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):669
                                                                                                                                                                                                Entropy (8bit):4.392258836691397
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmnqMVveSuXqVytjpdIYnX1Gcekt+7lUJJsUGF7pmAqjb6mUz:t4jU/vfSundBX8wt+osujsz
                                                                                                                                                                                                MD5:2FC469BBFA86F0452A71C0841D764880
                                                                                                                                                                                                SHA1:ED84D8A8D42D04498588E03C666FADED521DF292
                                                                                                                                                                                                SHA-256:27C9E5810D545D84F4968F1DDED0421E78F2B3C28C6C89DEF47D57E079AB1E90
                                                                                                                                                                                                SHA-512:30C0A81DF9B6BE79670031F934D364575E1A94ED4BB120032687794B15A48EA6C6130F1BFD29D71A094B35DF2FE4E8FDF470F87D0B2140641168CEF3B90DC04C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/radar_live/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-2-2 .9-2 2-2 2 .9 2 2zM6.36 6.33 4.95 4.92C3.13 6.73 2 9.24 2 12s1.13 5.27 2.95 7.08l1.41-1.41C4.9 16.22 4 14.21 4 12s.9-4.22 2.36-5.67zm12.69-1.41-1.41 1.41C19.1 7.78 20 9.79 20 12s-.9 4.22-2.36 5.67l1.41 1.41C20.87 17.27 22 14.76 22 12s-1.13-5.27-2.95-7.08zM9.19 9.16 7.77 7.75C6.68 8.83 6 10.34 6 12s.68 3.17 1.77 4.25l1.41-1.41C8.46 14.11 8 13.11 8 12s.46-2.11 1.19-2.84zm7.04-1.41-1.41 1.41C15.54 9.89 16 10.89 16 12s-.46 2.11-1.19 2.84l1.41 1.41C17.32 15.17 18 13.66 18 12s-.68-3.17-1.77-4.25z"/></g></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1007

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                Entropy (8bit):4.053508854797679
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:ez1h8FfY:Kh8Fw
                                                                                                                                                                                                MD5:A62223264CD530204B2933EF9B663F93
                                                                                                                                                                                                SHA1:7CD63C5A89DB974468AA6765C5BE8DC719AB811D
                                                                                                                                                                                                SHA-256:FD802AFC88F2A78C16207E7055F163D903BE3B32E3A11A95E84ACC6284798883
                                                                                                                                                                                                SHA-512:02276DFEBBC9C4BBA0286232D571C16155F017914CEB37B3F32FC12D3B81B174478C20444902E31957FAEF59BAD0C80D4D1D5241E5DBABDB69CB3F1314E9AE6E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAlyCXj1PD6lfBIFDb2Fgw8=?alt=proto
                                                                                                                                                                                                Preview:Cg8KDQ29hYMPGgYIARABGAM=

                                                                                                                                                                                                Chrome Cache Entry: 1008

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 21 x 409, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2540
                                                                                                                                                                                                Entropy (8bit):7.241602582463701
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:hjUR4TN+zzhq3Y40mP0VFx2teUFhZX3cUxadsKx6aBDLUSZ:V8cN93vQOeUFhZX3cJ/IaBDLzZ
                                                                                                                                                                                                MD5:617B29D87C8BE0A9E367320313656B2A
                                                                                                                                                                                                SHA1:46320109EDC1764CFBC60AD4F031E4018CF6ADEF
                                                                                                                                                                                                SHA-256:286E3110841E9FCE71D0E8CFCA1D1B7B0EDF781AF6D752ABF05F89AA6760EE79
                                                                                                                                                                                                SHA-512:42CEAF698DD7556BBA2BA11264B9923E66EBC514AF8554EBACF83391E7AA690E5DFAB2222872D40B61AE5FAF1500D22E6077808D0F5341088C70B36DEAA52C19
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/2UXBRrhCqJH.png
                                                                                                                                                                                                Preview:.PNG........IHDR.............Q......PLTEGpL.............................................................................................................................................................................................................................................................................................................................................................................................*m.5....tRNS.Z.$........>.........t@...\...V..J..D..*........X(.f......|"<d..`.PN.2.,....T.4H........p.~r..F LB0....b.&j8^6..hn.x.:Rlv.z=......IDATx^...S.I.../.......B.$."....`L..6`p.a.n..~..M......U.[E..T...*.~.....P.....O%.!...B...Ib......;.)..].!.....Z..:.[....S..!....[...Z....zh........g.....@.d..@......-.X......d3...fJ.q..R.Q...2X...ze.V...,....c..U.O.U.GW.[.......o(.,...j@.h~._....L.*.......K...ou..{...s..9..0.O.......LYM........[.+.....@..ldJD..G...W..+..........s.5.^..DCE....:...n...l..]E..).R.... 4hkH....x.V~S<2.I..[./..=...V#G....3D.NT..D.

                                                                                                                                                                                                Chrome Cache Entry: 1009

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):373
                                                                                                                                                                                                Entropy (8bit):4.744613189871505
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4aC/foF8mw4U0bW5RJDURmodj6iiYp1GTDWbyLsji:t47N9U/vmRtnY8/4U0wRJIAoZ6iiYp1U
                                                                                                                                                                                                MD5:25F33107B1ABE585D6667013A5EE0156
                                                                                                                                                                                                SHA1:08CA62806C11E78AFA36E27F4334593A721CDA78
                                                                                                                                                                                                SHA-256:D00CC0FA93D30CF63610BF1B33BB689DB1693D0B79968954EC376CB67E636D46
                                                                                                                                                                                                SHA-512:75851CAB4DCDEF5E5AB0DBCE7FED43007EBDD28DC79AF33BFD9F4D5C8CF714660822BBB17CACCA02DC7E1B8CF85A74122481BE30A901F35ACB3D61C5845D5983
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/fire/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M14 6V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29-.7 3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2l-6 4zm0 9.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.24 1.45-2.82L14 10v5.7z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1010

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (20386)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):51290
                                                                                                                                                                                                Entropy (8bit):5.67062493227705
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:I7SrUn4JzqiCXznnxmmUCf9zTvJFZ5KDHjC8m0EjF1lD+:I7yU46znxmmUwZ5F8m0EjFDD+
                                                                                                                                                                                                MD5:F207037DB3A765EDC8B767828B11363D
                                                                                                                                                                                                SHA1:E5F60C97DDDE25D3B48A9A9F74CAB63F08CF8FAA
                                                                                                                                                                                                SHA-256:1B00A4950D73F00CE45E398684D1636566BCCAFC73F645F15F39ED1CA8D03D9C
                                                                                                                                                                                                SHA-512:8FBB828BAB8DA3614E0491E5EA65541C1481D14B15398989B207DEDDC1D4AAE1192191D01948B89076191B018A0343DD9A13ED83C920D975AE9F40C23CB88A06
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iNTg4/yY/l/en_US/POamO_Ggpf8.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("FBReelsRootWithEntrypointQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7170528726358232"}),null);.__d("FBReelsRootWithEntrypointQuery$Parameters",["FBReelsRootWithEntrypointQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("FBReelsRootWithEntrypointQuery_facebookRelayOperation"),metadata:{},name:"FBReelsRootWithEntrypointQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometPageLayoutWithComplementaryContent.react",["BaseRow.react","BaseRowItem.react","CometMediaViewerFullscreenContext","CometRouteRenderType","CometScrollView.react","MWChatVisibilityOverrideContext","gkx","react","stylex","useMWShouldCurrentRouteOverrideChatVisibility","useShouldShowMessagingEntrypointOnCurrentRoute"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||(i=d("react")),k=i.useContext,l=c("gkx")("10418"),m=c("gkx")("10930");b={chatSliver:{backgroundColor:"x1jx94hy",boxShadow:"x1

                                                                                                                                                                                                Chrome Cache Entry: 1011

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):6508
                                                                                                                                                                                                Entropy (8bit):7.7974920633038165
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:En+eRLfquQsdW3KxS2Zp1sQprYEC56XXsaj2ERYxSdmu:fg7QsrS2z1fpMECEXXsznxIz
                                                                                                                                                                                                MD5:0CCB7485135A20477C2C04DF6CFC4130
                                                                                                                                                                                                SHA1:395EDD82D5215BA339F7112547F21CC01FEB3D86
                                                                                                                                                                                                SHA-256:7448E813822C62F2F4BCE6BAC9F0971FE47D46D916C548EEF91A9C965670514C
                                                                                                                                                                                                SHA-512:CCB7FB01F9DA762E051326B3AA0A92959D20854674C330E53B0F6F913C1292E3A11EE69A9407B25375A40802DE7FEE257B43FABAEB86E9DD587E0728FA4AF627
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/423525910_761159309258777_6357083414827650473_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=Ik7uKlunStkAX9--dNm&_nc_ht=scontent-lga3-2.xx&oh=00_AfA1cdMoz7sHavQX4fkUSH-ITsSsJXzJRRTy5YalAsESTw&oe=65D47BCC
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000b8040000ab0800000c090000a6090000530c00005d1000006b11000001120000b61200006c190000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."............................................................................. ..........................................................[.B3b.P}..Q-$.K..%...L..R.Z.w....*._JE.....;..3.3ZI)1_E*..,..A.` .....x..w..;.J..6.Q.....^lY.\.n.,..i6.Q...8.......'....|...h..o.z.5......|....]q...o..z.D.2+3M&..k..q...}...[....+....N.r.......u......=q.y1.....a..Y?"e>..9vO3...l<_X.P..W.Fs..._.....TP..M.,....=..y1..y..=.Y..a.<3..WLX.T..X...U.....z...m.2x.k.;.t..}...c.|...w.FZ..T..O...9>.=J....V....}e.,.d..0I...H...v.?~y......b..y...'-}.."\..|.m[oM.s..V.vP+.l~l.......un........>...L{..}or.L.\..g.;.....F|.3e..k.x........k.~.&...........i.<{.....s.z..f[K..Q#&<.q....

                                                                                                                                                                                                Chrome Cache Entry: 1012

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):43144
                                                                                                                                                                                                Entropy (8bit):7.995443944037105
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:768:em2MZ79SAuF+rezciOIXG4v0vcASaBiaDpucW44Kz0AKcn72F2Dp:EE2+KciXG4vcSaBzucW3q0ADDp
                                                                                                                                                                                                MD5:718A286C568366664234CECF5BAF7734
                                                                                                                                                                                                SHA1:D9D550CBEB865F0F0EBA211C79B47F29083589F0
                                                                                                                                                                                                SHA-256:5E2F0C020AEE48459C7E4436B0384B312F942C25EE0480032439C7BEB8107202
                                                                                                                                                                                                SHA-512:623A8724711BED933653D6674155A4F5702F0D78700BEB193A39F33248B2A6175D55C7E3D959B1D85CBA8A0F443DBC8B51CB86AB0C3CDFC818EE8D74A003E2A7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/Bn_5uH5kUAU/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLCMcoHlLjuGrfeMm3wrXI4vQQL6Iw
                                                                                                                                                                                                Preview:RIFF....WEBPVP8 t...0....*....>Q$.E..!'&.[....emV.W+...`.....XY..+.&c..D.Y~....{.....r..{.W.'..;...a....M..u...o.............m.....O.g...^.....[...f.]...........u...............W.L.j........m....................~|......O.......s./.{._f...7......l~\}...._..l........=......_.?.......:>..........O.W...`>.._..........+~................g.........................>.......^x-.o&......:K.)../Q.Mj......gC.y+q.>j......RQ..s..J..{.D...L..w.pD...L.+.F..\;D!.M..S..-...V.pd......~F7.S.o~.x.........a.q...>..........7....!..F...0p.J=QQ.....X{8.V.1.1.#..Q.E.?V.rf..A..Fe......<.%..V(r{O....).X.M:d..E..P?/..rL2.pky.....).....$Q.V.6?aN..,......h. M..g.........t#.q..C.w..D4p.A.q..."\...."N......Pu.......cj.e;Q..P.t4.o..T...oH.p.up...\.<Z...eb~P"...:..&..9Q..c....w ..w.=.Y.....f.d.c.@-..D...Z..?5<.#.}.y...[\\.}:......(b...8....}?1..v4_..8[).Y..#0U.2...u...>........I.S..N.....3........~Ci.p..n....08o....W}...`.k=..sn...E.Z-q"...ED.c..Dz&a(.......7i.Z.5N&Y.e..e...i

                                                                                                                                                                                                Chrome Cache Entry: 1013

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):311
                                                                                                                                                                                                Entropy (8bit):4.773843844737949
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4tSSJhrtldwFSrSLwKTksQchiR29UZqbivGSY:t4noU/vmRtXrtvwFSgTksJh42K9pY
                                                                                                                                                                                                MD5:D5E9A724519F1A72A4FEECDEA710B2D7
                                                                                                                                                                                                SHA1:75040CDBB6269D16066A1CC97973CBD35FB3EAF6
                                                                                                                                                                                                SHA-256:119BEF082F4459AC47AC8C95CC7F5901D60BF2AFE47DE7314E479BDA835CD593
                                                                                                                                                                                                SHA-512:55A2C26244423311D30C64F06E1AFAD3035D318F7948FED5F2D386FFE9AF1C48077F59036FB1B8BD368875F953CC2F2BE627CD6F5231CEE5119961CA523E8716
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/arrow_time/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 2C8.73 2 5.8 3.44 4 5.83V3.02H2V9h6V7H5.62C7.08 5.09 9.36 4 12 4c4.41 0 8 3.59 8 8s-3.59 8-8 8-8-3.59-8-8H2c0 5.51 4.49 10 10 10s10-4.49 10-10S17.51 2 12 2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1014

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                Entropy (8bit):5.038914846080771
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHeQR+HEp3JdZFQENIfCyHn:tI9mc4slhLJ9hC/vm+QqaXFXaKyHSbE
                                                                                                                                                                                                MD5:C71D43D3179551ACAFF38A6A24DEDA71
                                                                                                                                                                                                SHA1:9BE42687E42147DBFEA9C1CA9486CCFE6DAB9F96
                                                                                                                                                                                                SHA-256:4402C4D35A422097E5AC692FF4EF5182F2E3B72F5A0F710C230A18D6449C688A
                                                                                                                                                                                                SHA-512:11BBD2FAC3FF1C144F3F18C60975DD679DEC6C23081621DB874DD1057906A5085B73E998332E1B2C2E511AE55D481980DC3E011588487D2779297B6119BCC79B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/home/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M4 21V10.08l8-6.96 8 6.96V21h-6v-6h-4v6H4z"/></g></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1015

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5430
                                                                                                                                                                                                Entropy (8bit):2.6465732373896285
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:Es5ed8vZa+/kffJTyN5J5iXSvjDxatgFFjiZq1MJUikeVgl2fwFfBaTzh4mpCbak:2fq3OqXAzh4jaJV9HxG8Q
                                                                                                                                                                                                MD5:3E764F0F737767B30A692FAB1DE3CE49
                                                                                                                                                                                                SHA1:58FA0755A8EE455819769EE0E77C23829BF488DD
                                                                                                                                                                                                SHA-256:88AE5454A7C32C630703440849D35C58F570D8EECC23C071DBE68D63CE6A40D7
                                                                                                                                                                                                SHA-512:2831536A2CA9A2562B7BE1053DF21C2ED51807C9D332878CF349DC0B718D09EEB587423B488C415672C89E42D98D9A9218FACE1FCF8E773492535CB5BD67E278
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/yT/r/aGT3gskzWBf.ico
                                                                                                                                                                                                Preview:............ .h...&... .... .........(....... ..... ..........................................h. .f...............f...g...d.@.........................`...e...f...f...............f...f...f...e...p...............`...f...f...f...f...............f...f...f...f...f...p...........e...f...f...f...f...............f...f...f...f...f...e.......d.@.f...f...f...f...f...............f...f...f...f...f...f...h. .e...f...f...f....U..........................y'..f...f...f...g...f...f...f...f...............................U..f...f...f...f...f...f...f...f..................................f...f...f...f...f...f...f...f...f...f...............f...f...f...f...f...f...f...f...f...f...f...f...f...............p...f...f...f...f...f...f...f...f...f...f...f...f...................d...U..f...f...f...e...h. .f...f...f...f...f....d......................f...f...f...h.@.....f...f...f...f...f...f....t.................f...f...f...........p...f...f...f...f...f...f...f...f...f...f...f...f...`...............p...f...f...f...f

                                                                                                                                                                                                Chrome Cache Entry: 1016

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):631
                                                                                                                                                                                                Entropy (8bit):4.523426024540581
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRlNAz9Cf2+uFNxLjRJqpOyaIj24iexYNjbnME:t4jU/vwAz9C2NDx7MraCvC/ME
                                                                                                                                                                                                MD5:CF8624D2CB9D056B69F4240D26676F42
                                                                                                                                                                                                SHA1:B6D1C7111D039427E2605490C40992C47021E1C7
                                                                                                                                                                                                SHA-256:384FBC48B9DAAAAE43546C01BAAC0F19EAF764549ABC66FE69A9E9675A14D0A3
                                                                                                                                                                                                SHA-512:8500302D48ACDDAD24B051A44482305D92B349A054BF006E0FCA901DC55CC06DF826D28A39432ED7A92B7FB76E1D351945606DA87A0F0D3127E66D1CF2DDC90B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/broadcast/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M13 13.72V22h-2v-8.28c-.6-.35-1-.98-1-1.72 0-1.1.9-2 2-2s2 .9 2 2c0 .74-.4 1.38-1 1.72zm-5.23 2.53 1.42-1.42C8.45 14.11 8 13.11 8 12c0-2.21 1.79-4 4-4s4 1.79 4 4c0 1.11-.45 2.11-1.18 2.83l1.42 1.42C17.33 15.16 18 13.66 18 12c0-3.31-2.69-6-6-6s-6 2.69-6 6c0 1.66.67 3.16 1.77 4.25zm-2.83 2.83 1.42-1.42C4.9 16.21 4 14.21 4 12c0-4.41 3.59-8 8-8s8 3.59 8 8c0 2.21-.9 4.21-2.35 5.66l1.42 1.42C20.88 17.27 22 14.77 22 12c0-5.52-4.48-10-10-10S2 6.48 2 12c0 2.77 1.12 5.27 2.94 7.08z" fill-rule="evenodd"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1017

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):24145
                                                                                                                                                                                                Entropy (8bit):7.92967885732341
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:zskzj3htkpkSLfdNqCt56xm54Ulv1diXv7PabzMgn6X4W+4/MAsubd:zs2tkpkodNqCt8x2HdGCN6X47By
                                                                                                                                                                                                MD5:BBED81853E2FF0BEB3A36321B0109BF9
                                                                                                                                                                                                SHA1:96E8A50660B479D32E5E3A7420962EE79C764A6F
                                                                                                                                                                                                SHA-256:83FCC2EC7B96E62B420D0786C63EED267FC0C3A06F55C11010EE49521C9A21E2
                                                                                                                                                                                                SHA-512:0F0D07BE03B1EB7AB4B2E4C3891FB96E88239D35C50AF30724B2577028556EC785C919AF756D8130665DDF7DAFDCE11F53B6D9B3DEF401548BE6080796098079
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/425977435_1056056785623039_2717807648311887768_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=KwrhrTrFciMAX9M0ljb&_nc_ht=scontent-lga3-2.xx&oh=00_AfBuDWZhnsDktOaRAbpbuartBWT2kslSAdffDuwXtlxbYQ&oe=65D442A0
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e01000095130000921d0000461e0000041f0000f12000007a300000aa3600001d38000089390000515e0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................2..`...`...(..B..$Q!I"..HQ!I".c.1"....B...i.....h...!..V b. b. h.........@.........1......$(..... -H1"...5@...1..1..1..10.4..&..M......h.......C.1..1..2Db......1..1..10....RL....... b...........@........A.u.$..6.D... bE.. b`.... ..@..H.B...)$Q,d......@. .....U...c..@..Lb.....B..p.$. ..@Y..B..HQ,b. bE.......c.1..........{...................C(.Y!D2..$) iH.`.yQ.,b. ...L....b. b. bE..$(...<~|o...gU....p..[yY.I...}..9....g.....h..=..{.?x.<..x......K..........s.K..z....:.>Gux.'.p.....,...R .e.......<.2k.X.@)..o....E...x..4.i>...u....;<._w..i.g..O...._.n{.<0..'>'gO..z....L{...Q.<..>......=...

                                                                                                                                                                                                Chrome Cache Entry: 1018

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.google.com/pagead/lvz?evtid=ACd6Kty4_Jpl6hu735JQR8flsyo0Q1kBxD2cdU82n67TkwI-1ArPGJyro1lG6r74obXWIEeCeL5zT0iAST0gxO2f5jooiyDsIg&req_ts=1708035678&pg=MainAppBootstrap%3AHome&az=1&sigh=AB9vU41swmyjmX1BwJ_NADLPempSkYBShw
                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                Chrome Cache Entry: 1019

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):216276
                                                                                                                                                                                                Entropy (8bit):5.455491059432931
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:E0nzyu8ItYoHFldaY4xzuQVLlGDPcHGcpP:lnCuYgTaY4/GqGQP
                                                                                                                                                                                                MD5:A1C97A27D5C64B97D4E96D5EACA3B8AA
                                                                                                                                                                                                SHA1:89C48372DBAD07D2EFE10475B14E6CDCA0BC2E80
                                                                                                                                                                                                SHA-256:C150006B9F983B4716C91B10C2E5888857F52E303BE151F27A9DF26FF2CE900B
                                                                                                                                                                                                SHA-512:7D18B750F8293E0606A43FC114D7E2AA0BD671C1A552F955A5A0137AB9F03ABD27AB03E3127E0E7BAE8B5947F301B5139FA0227DE8B6E2B8FB232A2679F5AD18
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFU0Eb88gCMWemHf1wS2H0QUzNV-Q/m=_b,_tp"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x689603f, 0x2040058e, 0x3f34e599, 0x30e4e33d, 0x0, 0x0, 0x3006b000, 0xe, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Ra,haa,$a,cb,db,eb,fb,iaa,gb,lb,jaa,kaa,pb,naa,paa,Eb,qaa,taa,vaa,Aaa,Qb,Caa,Daa,Iaa,Oaa,Paa,Maa,Qaa,Vaa,Waa,Yaa,Zaa,$aa,aba,Lc,dba,cba,fba,Pc,Oc,hba,gba,kba,jba,Vc,nba,oba,dd,cd,Rc,zba,wba,Aba,Bba,Eba,Gba,Hba,uba,Qd,Rd,aca,je,cca,ke,dca,fca,hca,lca,mca,nca,oca,rca,tca,xca,yca,Cca,Mca,Ica,Oca,Qca,Rca,Uca,Wca,Zca,$ca,ada,bda,cda,fda,jf,gda,ida,lda,mda,aaa,nda,Af,oda,Cf,pda,qda,Ef,sda,Gf,zda,Dda,Cda,Of,Fda;_.aa=function(a){return fu

                                                                                                                                                                                                Chrome Cache Entry: 1020

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):15860
                                                                                                                                                                                                Entropy (8bit):7.988022700476719
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:S7qmPTF4N21t//YW2FS6+1XxrsbGmjlAbvqMmtCN:S621tHY4xwbGmjloSM7N
                                                                                                                                                                                                MD5:E9F5AAF547F165386CD313B995DDDD8E
                                                                                                                                                                                                SHA1:ACDEF5603C2387B0E5BFFD744B679A24A8BC1968
                                                                                                                                                                                                SHA-256:F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
                                                                                                                                                                                                SHA-512:2A71EDB5490F286642A874D52A1969F54282BC43CB24E8D5A297E13B320321FB7B7AF5524EAC609CF5F95EE08D5E4EC5803E2A3C8D13C09F6CC38713C665D0CE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
                                                                                                                                                                                                Preview:wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP*..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........*W.......S...hT,.l..'.9.;[@..._.L..|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'|Z........a....^.b...o.>...g........f../w'....Ja.o(

                                                                                                                                                                                                Chrome Cache Entry: 1021

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):216277
                                                                                                                                                                                                Entropy (8bit):5.455502756372822
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:j0nzyu8ItYoHFldaY4xzuQVLlGDPcHGcpP:QnCuYgTaY4/GqGQP
                                                                                                                                                                                                MD5:92BBD73283CCF052912D68922E212C38
                                                                                                                                                                                                SHA1:92F9A1D0628EE58A31E234953548FF16E3B390B4
                                                                                                                                                                                                SHA-256:BD33427A7076736CB9783D3E994B178A1882002E5B3F2D902D204A47A96AEA77
                                                                                                                                                                                                SHA-512:D854079F95E08F624D8B0E27732F54A8D17C33B0F3661E7D9370CEC5418605BBBCC689930462A261CD92570CE4F30CD8457A4CDA702C29B73DA05B00628FD0F3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEEgWEfV3yt47xiVu7pvO4I3STIzw/m=_b,_tp"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x1689603f, 0x2040058e, 0x3f34e599, 0x30e4e33d, 0x0, 0x0, 0x3006b000, 0xe, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Ra,haa,$a,cb,db,eb,fb,iaa,gb,lb,jaa,kaa,pb,naa,paa,Eb,qaa,taa,vaa,Aaa,Qb,Caa,Daa,Iaa,Oaa,Paa,Maa,Qaa,Vaa,Waa,Yaa,Zaa,$aa,aba,Lc,dba,cba,fba,Pc,Oc,hba,gba,kba,jba,Vc,nba,oba,dd,cd,Rc,zba,wba,Aba,Bba,Eba,Gba,Hba,uba,Qd,Rd,aca,je,cca,ke,dca,fca,hca,lca,mca,nca,oca,rca,tca,xca,yca,Cca,Mca,Ica,Oca,Qca,Rca,Uca,Wca,Zca,$ca,ada,bda,cda,fda,jf,gda,ida,lda,mda,aaa,nda,Af,oda,Cf,pda,qda,Ef,sda,Gf,zda,Dda,Cda,Of,Fda;_.aa=function(a){return f

                                                                                                                                                                                                Chrome Cache Entry: 1022

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (4264), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):4264
                                                                                                                                                                                                Entropy (8bit):5.023352101476255
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:cMR3GqZFZlZuAwkQ29BR6WtFfH/2Ff8FfSiY3hUgxJu8OJ/:cxC3wkQ29XtEmgiUhUgxJu8OJ/
                                                                                                                                                                                                MD5:9DEAE13C40798DFCA19BD14ED7039D60
                                                                                                                                                                                                SHA1:4BA302A1435B094031E4F2E1BCE1B6198F0CF825
                                                                                                                                                                                                SHA-256:CDAC5527DC3C1A9F38C6B00086B2A10B9E7EAA1E062314E548C1FA602D17BBBD
                                                                                                                                                                                                SHA-512:95B093D926535FA9454E3776A3E219B61502CE67AA2E659175AE879133DD35A6EFA1BFDBE5B6D3E3DD8BA1F0663892B44FD6F21BE17FEFA9725A234DFF3C5D0C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/cssbin/www-main-desktop-home-page-skeleton.css
                                                                                                                                                                                                Preview:#home-page-skeleton{position:relative;z-index:0;pointer-events:none;min-width:0;width:100%;opacity:1;margin:56px 0 0;display:-webkit-box;display:-webkit-flex;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;flex-direction:row}#home-page-skeleton.hidden:not(.layered){opacity:0}#guide-skeleton{display:none;background-color:#fff;width:240px;-webkit-flex-shrink:0;flex-shrink:0;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-flex-direction:column;flex-direction:column}#guide-skeleton.collapsed{width:72px}#guide-skeleton .guide-item-ghost{padding:10px;width:100%}#guide-skeleton .guide-ghost{padding:10px 30px;display:-webkit-box;display:-webkit-flex;display:flex}#guide-skeleton .guide-ghost-icon{height:40px;width:40px;min-width:40px;margin-right:15px;border-radius:50%;background-color:hsl(0,0%,100%)}#guide-skeleton .guide-ghost-text{height:36px;width:100%;border-radius:8px;background-color:hsl(0,0%,100%)}@media (min-width:792p

                                                                                                                                                                                                Chrome Cache Entry: 1023

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (516)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):9642
                                                                                                                                                                                                Entropy (8bit):5.435855411923511
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:flejPRjM65ile/Q0Y5CaNLMASVZkXK7aACjbN9LDXxdZ7G92tXL74dESC:1oURjwgXK7aAq9LDXxdZ7G0tXL74dESC
                                                                                                                                                                                                MD5:DAC3D45D4CE59D457459A8DBFCD30232
                                                                                                                                                                                                SHA1:946DD6B08EB3CF2D063410F9EF2636D648DDB747
                                                                                                                                                                                                SHA-256:58AE013B8E95B7667124263F632B49A10ACF7DA2889547F2D9E4B279708A29F0
                                                                                                                                                                                                SHA-512:4F190CE27669725DAC9CF944EAFED150E16B5F9C1E16A0BBF715DE67B9B5A44369C4835DA36E37B2786AAF38103FDC1F7DE3F60D0DC50163F2528D514EBE2243
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/scheduler.vflset/scheduler.js
                                                                                                                                                                                                Preview:(function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var l=aa(this);function m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}.m("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}.function c(f,y){this.g=f;k(this,"description",{configurable:!0,writable:!0,value:y}

                                                                                                                                                                                                Chrome Cache Entry: 1024

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3100
                                                                                                                                                                                                Entropy (8bit):7.814860992383091
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:UK3BDHJJh5EM1EOilI0j+DVx094+4yjm1J8Mh0NYRx0BdJO:xJTRZM9jorqjm/Z0zdJO
                                                                                                                                                                                                MD5:0108708452D04A16415199B33D5BE25D
                                                                                                                                                                                                SHA1:35578A9B80990AA57FA3CAFF8C1284538766933D
                                                                                                                                                                                                SHA-256:65CF9F449CC8EF0288A5B5CF9EE97D7B11519ACE1CE7913AA6D4D22FD96D89F9
                                                                                                                                                                                                SHA-512:20ACBFA3A714D09D3520B38B8AB933752702176C41484A8CFB9AE59204A71300B802B824B1F73E0DE8F90CB0C61CA8EC91CE8A576EF2C56AF49FE8C1BD2AF370
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/ytc/AIf8zZRkvaqrb-dn3x70pxJFO_AIXg_1EJN_qPJHUYed0Q=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D............................................;.........................!....1"A.QR#2a...3q....$BCT......................................<.......................!..1.AQaq."2...Bb.....r.R...#3S................?..1....0.0.0.0.0.0.0.0.lnWr...Q.[...Dr..e...,..#rSK.....G.Lz..ZQQ...eK.r5q{i.:.8UErT.9X.9.Av.@.k.o..g?M'...F8..a|W...:^....1.#_.;.u|..?.59.;".5...F..hB......3....8Wt?y,/..x....3...I<o......pd...<.+1...*e......Z.b@ .nm....trL.....C....KJ...T..x.....F.^.3..*.......D...8...tw....>c.F#..+.I..x.....0..k....S..".....[..*<Ji.O..&.anno.5.=M...vVp,.M.e..q%.$0.^rJ.hT..9].zLd...cy..Q.......v*H..W.<.rB..=.TK.o.ox.PV>R.P;E*.Q....2=....~g.S...2..Ru......P...P....Ny-...L5...,.SU..."....O._..O..i.h.*.U._.$).~..$..<......}.f+R.U.X...Q......g..k.. .H$!t.19M@}...|....zJERj."z.

                                                                                                                                                                                                Chrome Cache Entry: 1025

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):15920
                                                                                                                                                                                                Entropy (8bit):7.987786667472439
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:sShqOXQlaSchOwK0uFvRqq3xR/xb5OY3aU/lHS9WE2YeK1os:sShJKaScJK0uFvRvxb5OY3aU/lHkmK
                                                                                                                                                                                                MD5:3A44E06EB954B96AA043227F3534189D
                                                                                                                                                                                                SHA1:23CEF6993DDB2B2979E8E7647FC3763694E2BA7D
                                                                                                                                                                                                SHA-256:B019538234514166EC7665359D097403358F8A4C991901983922FB4D56989F1E
                                                                                                                                                                                                SHA-512:FAB970B250DD88064730BD2603C530F3503ABB0AF4E4095786877F9660A159BF4AD98C5ABEA2E95EB39AE8C13417736B5772FCB9F87941FF5E0F383CB172997F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                                                Preview:wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.*5..?.o.|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..*7.....<|..i...{...R.M+[..|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

                                                                                                                                                                                                Chrome Cache Entry: 1026

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):68010
                                                                                                                                                                                                Entropy (8bit):7.996915813085905
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:1536:7ToDTu1G//Vbh9UyMlD6GzesNe4duEGY2yCE69rcX6+uEaXpzy:oO1UJzUyMl2GiJhEN6iX6+uHty
                                                                                                                                                                                                MD5:A44E4325C103AE379DFF85F6DE67D8B8
                                                                                                                                                                                                SHA1:3BF90E05564E6C4C3969D124FC81152179311980
                                                                                                                                                                                                SHA-256:4C571CE72D27998AB79446030ABCFD1D7D067ED03058D01C6E838B8D12FD1EA4
                                                                                                                                                                                                SHA-512:7F4A5E006E5CBFC16674BA56E87008E89CFB645A3CC80CDFCC09C168CB20F7139A96180F168C1EBC559676F4468E913E86B61E5A691BF65061138A5FFB79482D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/sWartg-GwpM/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBcbL4eP6BOIOAD4HuYeXui5aBItw
                                                                                                                                                                                                Preview:RIFF....WEBPVP8 ........*....>Q .D#.##-Y.`p..fn..V,.r....... ......Dw...D.*......_.y....wt......I.J....s...'..._.?.......t...G...W..@.....[.?.....~...............~.}............O..<..~......./....._..3..?k=....y.....?.O..............._.?..qo..?..........3...?./...?........w............g.....g.......=E......$..._......%.[..W.....o.?..;.'...?.x...........P.}.....w..o{.6...~.~.}..w............O.^._.......o._....|..:.......?.o._..........O...?........s........._.=.~....O.................v.&....+c....`..10.......B-Bp^.S..4../.N..G...Y..bG.....s..=Jl\....l..PI..K.+...G..x......N...i....z...:...&.I.'.B..%.O:4..x..w..M..s...n.....=..b..W.\.S&.:.Mr.I.Y^.......T.n.I.F.!.^.7...kh.?F.R.....'...L....3:.%.R0........@.V.`$.t=@.*a`.(.1.-.._..h...O...+....AL.N.>sj.]%.'..x....?...??.l....E~.n......A.]...2R'.E..}..3.....Gc....K.Q+.A.......y.....7...............Q........D..p.......sAB..N...W)P.w..)Y..E.W.l.M@...G...6...T.r5....A.@....D =#.0...K...3.W..v.A._u..a..K..

                                                                                                                                                                                                Chrome Cache Entry: 1027

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x270, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):13964
                                                                                                                                                                                                Entropy (8bit):7.985031297038588
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:kJN3+ny5jQuMf537C21d0SYE5HR3yFBJTXbg7dpN7:G3YyZQuMhrFLYiHR3ynJo7dD7
                                                                                                                                                                                                MD5:CF4F8D3D0DC397E5775EB0E6F885F089
                                                                                                                                                                                                SHA1:16502A5F2DB0BBBF047F3B41BAF3DD2B0664660E
                                                                                                                                                                                                SHA-256:649A403786D1D03F8B1D2B8604D133D981DDFE9EF51E5D9CC9849761AD6393E6
                                                                                                                                                                                                SHA-512:5ACAC761883C5CB1EBED09181C52F852698461D4D6509D6611752232466AE5864E20BDCE8B8EE75DE713174F782AD46E5EAAD81777FD2144A664ADD70E93AB7B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/tcQVrD7RnNI/hqdefault.jpg?sqp=-oaymwEcCOADEI4CSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBdkJtqaaptnfXvJeVfVcz4FLDu-Q
                                                                                                                                                                                                Preview:RIFF.6..WEBPVP8 x6..0....*....>Q$.F#.!..p.8p..enK....\...x.i,.Z*....mOk.N...i....1....?q.......7.....M{..[.....c....B...z........g..\G.O.._.o.^......................._......g...O.........^....2...u.g...Nw}...P.c>............G............I.+.=.............}..(...{.....o.o.?.~..........?..b..?........_......g....?.....r.J.w-U}.1........>.....%.....F......~9.....L...w.!$...T.d..o.7....."g.a..........S..=<.s....y.,&......TXS.E.W.Si..p/Iu3..r.t....H.&.._`..].Eh..b...V...T^...`UC...9l.......5...P.>I.G=.L~K...Y(........u.]K..7.....q.-.P.c7D.!5OC...6.uS.......kJ4..h..'(.97.5..|.&c...A..!..w.2..z...g..8...o.<i..bCY....W.X.f...Oh..2..Kc..t..hiUt..|p.E.>*.......Gw.U....u..goJy...!7..\.DZjd.Uz..yv.....k.*..:.Z...)i.....0x.TM.@g.......Z..2.4k.....ds..E....56......j..<.r}......&.y.5...Tj.I5[}......+.._.`.......G.F.<.'.....~_|..!........YJ..V@4SH.._.R.\`3ZOw.:._..9z.V.v./.D..."T[....L...1F..T.n.T.R...#H7.{.....]...&..<0^(.:.RH0....eb.x$.../Ug...GF.c..Q

                                                                                                                                                                                                Chrome Cache Entry: 1028

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (58866)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):121373
                                                                                                                                                                                                Entropy (8bit):5.175748296577059
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:sLQpmW+m/KTYGu9AoaI/mQVzm75W8Zcz834SS40FGXUQvqO4pxuor3lQNO301J86:ZI2eIgRZGQLv90/I9aCIqYQpp
                                                                                                                                                                                                MD5:FD54CEDA35435FE8F2052A1AFFA8B9F6
                                                                                                                                                                                                SHA1:A5F7861296607CF1569E287E89525B686573247F
                                                                                                                                                                                                SHA-256:055D56D9F8D452CB0F8198D624BC7A612B7A2A471EC7871DD2BE7A74F5151E3F
                                                                                                                                                                                                SHA-512:E951FAE6B47F0141397CFC3484578082246272BEFE14636B8BA9BE56DD096D5DB43A2DEB8F947B9B55A56E3BB93EAD63D029274551F51922F329E64E4219AA8B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iKvn4/y-/l/en_US/Rjgwe3mqaki.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometUFICommentListRendererForCommentsAPITahoe_renderer$normalization.graphql",["CometTextWithEntitiesRelay_textWithEntities$normalization.graphql"],(function(a,aa,b,c,d,e){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},b={alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},c={kind:"Variable",name:"location",variableName:"feedLocation"},d={kind:"Variable",name:"use_default_actor",variableName:"useDefaultActor"},e={alias:null,args:[c,d],kind:"ScalarField",name:"can_viewer_comment",storageKey:null},f=[d],g={kind:"TypeDiscriminator",abstractKey:"__isActor"},h={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null},i={kind:"Variable",name:"scale",variableName:"scale"},j=[{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null}],k={alias:"profile_picture_depth_0",args:[{kind:"Literal",name:"height",value:32},i,{kind:"Literal",name:"width",value:32}],concreteType:"Ima

                                                                                                                                                                                                Chrome Cache Entry: 1029

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1394)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):282843
                                                                                                                                                                                                Entropy (8bit):5.635637088050171
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:G6W8fTBA4PJNu4j+09RCERy1SRjVxjw3rZOZWHxnrCi3UHZT:t2I9Rtw7ZOZWHsi3Ip
                                                                                                                                                                                                MD5:ADA75D73E83CEA535B1DEDEDF86548D4
                                                                                                                                                                                                SHA1:AFF832DFD50B4577C500D461DF07A787E178F140
                                                                                                                                                                                                SHA-256:CF6BBD610738E943187C290C0E84FC1D8BDFD5BC861447DC1CD9878C992C5D23
                                                                                                                                                                                                SHA-512:B9362DF6192152A3A345DC59975CD7CD19E0D39A969D3DACE1E9CCCBD4B44334C814664BBC711F75E9FDD6F22E830639DC4F2DAD3E5DD0702EFC2BF23D7292D7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/www-searchbox.vflset/www-searchbox.js
                                                                                                                                                                                                Preview:(function(){'use strict';var m;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ea=ca(this);function v(a,b){if(b)a:{var c=ea;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.v("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}.function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,va

                                                                                                                                                                                                Chrome Cache Entry: 1030

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):315
                                                                                                                                                                                                Entropy (8bit):4.648861696465887
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4LIPGDQyIlOWLVJ1WnkX2Wtti0+DrTwtDZi:t4noU/vmRLIO8yIlVVuPWI0gTGQ
                                                                                                                                                                                                MD5:9F40343399D2331A8E5DE01251A1F258
                                                                                                                                                                                                SHA1:FF3A3A2AB18BAFA30B09E09A083C3699263A10FC
                                                                                                                                                                                                SHA-256:CB4F6AB460370D669DE4694A4FB0090C3FADBCDB8C395C813A0680C90C29BFF3
                                                                                                                                                                                                SHA-512:3F888927E6DE57D021AA124C5894CAFB54BEE195047D12AB55FDED7C6444AB14C3CE4F3DCAB9E9D06E785EA82FC7A96BE4EAAB6639BF721FF6F698D8760486ED
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/mic/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c-1.66 0-3 1.37-3 3.07v5.86c0 1.7 1.34 3.07 3 3.07s3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3zm6.5 9h-1c0 3.03-2.47 5.5-5.5 5.5S6.5 15.03 6.5 12h-1c0 3.24 2.39 5.93 5.5 6.41V21h2v-2.59c3.11-.48 5.5-3.17 5.5-6.41z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1031

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):331
                                                                                                                                                                                                Entropy (8bit):4.856840067199089
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4bib4Gt/6qnFJ+5LZ9i3JvGUuWLV1iDQ38:t47N9U/vmReb4s6qbmqvVU8M
                                                                                                                                                                                                MD5:F7D38F81D0E430C65C517D480A82DEC2
                                                                                                                                                                                                SHA1:61A70D1586756FC2570A6DF4B440C10EBE3312B0
                                                                                                                                                                                                SHA-256:D63DF87F634535A4731B74CD9893C855373507C3250FF485E982442DAB0380BA
                                                                                                                                                                                                SHA-512:273652346614D9F8DE8B0AAB7BD13D4F5EBFBA1D27338D87E4F27DA58925FA9699E0367C9C0B74BCF6AF95AD5B9A48ECCEE0710F1593ABB96B705A551D202FE9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/mic/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M13 18.93V21h-2v-2.07c-3.9-.49-6-3.8-6-6.93h2c0 1.93 1.36 5 5 5s5-3.07 5-5h2c0 3.13-2.1 6.44-6 6.93zM12 15c1.66 0 3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3S9 4.37 9 6.07v5.86c0 1.7 1.34 3.07 3 3.07z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1032

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):312
                                                                                                                                                                                                Entropy (8bit):4.958737908772462
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4AFMGaBoxnOLgQsS0ISSa/KW8xGeDogniLELo:t47N9U/vmRXGaBoVOLgbvSoN8xGzEo
                                                                                                                                                                                                MD5:22698ABCC833E1218C3EEED7C534A400
                                                                                                                                                                                                SHA1:247102BA81E345DFD0C7374C4AB9B894C8A9704B
                                                                                                                                                                                                SHA-256:A3A94E1842AA40BD34D65EFF8EA6F8EAABE15CC9947C26FE1CFFB3274F83121F
                                                                                                                                                                                                SHA-512:E0C67655E2E2A955D52D0B1415A3931C5D2111AD12E66BCBDB89C4E4AF3E27701CCB5407F62896C2340BACF7D20E86C2ABCB03332C76C48AE62B83BCB1B612C4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/thumb_up/v17/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M3,11h3v10H3V11z M18.77,11h-4.23l1.52-4.94C16.38,5.03,15.54,4,14.38,4c-0.58,0-1.14,0.24-1.52,0.65L7,11v10h10.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1033

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):623
                                                                                                                                                                                                Entropy (8bit):4.2763238556132555
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4novnl/naqvgL2IUptn5oPNL8zABU8mNtirRO6W2haEcyVToar94gy5kmluUVF0:t4ovnx8L2IUpJmPNL8EBENElW2haG9rH
                                                                                                                                                                                                MD5:4DAF8785182AC1E5611B71758B96C865
                                                                                                                                                                                                SHA1:D065E53E7D208101346CEA65C9F021B3FD4CE45C
                                                                                                                                                                                                SHA-256:E8AECC1EE2FE7D415AD9EC08091D21A88B0B98CB91703534962C3A919A7E11A5
                                                                                                                                                                                                SHA-512:34AC148520872D75A4784DBAFCCDEA453C3E45479BC41E73335865138AFBD5D9196D38400B0CCAF16C43C45947296AC057E136BF7DB444CCB0D141D3B6049C0B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/16px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="16" viewBox="0 0 16 16" width="16"><path d="M9 8c0 .55-.45 1-1 1s-1-.45-1-1 .45-1 1-1 1 .45 1 1Zm1.11 2.13.71.71C11.55 10.11 12 9.11 12 8c0-1.11-.45-2.11-1.18-2.84l-.71.71c.55.55.89 1.3.89 2.13 0 .83-.34 1.58-.89 2.13Zm-4.93.71.71-.71C5.34 9.58 5 8.83 5 8c0-.83.34-1.58.89-2.13l-.71-.71C4.45 5.89 4 6.89 4 8c0 1.11.45 2.11 1.18 2.84Zm7.05 1.41.71.71C14.21 11.69 15 9.94 15 8s-.79-3.69-2.06-4.96l-.71.71C13.32 4.84 14 6.34 14 8c0 1.66-.68 3.16-1.77 4.25Zm-9.17.71.71-.71C2.68 11.16 2 9.66 2 8c0-1.66.68-3.16 1.77-4.25l-.71-.71C1.79 4.31 1 6.06 1 8s.79 3.69 2.06 4.96Z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1034

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.google.com/pagead/lvz?evtid=ACd6KtxGvtSuD8kxCqtCXliuVWv_7FnybLnJpcsArA6JXy-D60MPHqb4KHoocFf2W23I0E8FXR6Rh4Jdpr7_tNY8-jSahHNQgw&req_ts=1708035677&pg=MainAppBootstrap%3AHome&az=1&sigh=AB9vU40d9RlLTcxX3xGb8s7i0MrPq_JuMw
                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                Chrome Cache Entry: 1035

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):52
                                                                                                                                                                                                Entropy (8bit):4.542000661265563
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
                                                                                                                                                                                                MD5:B3B89B9C275343BC6798E3A83564FDDB
                                                                                                                                                                                                SHA1:32367475C527C3F5E5DB0BF42C348816FF4D157B
                                                                                                                                                                                                SHA-256:900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
                                                                                                                                                                                                SHA-512:ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                                                                                                                                                                                                Preview:CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

                                                                                                                                                                                                Chrome Cache Entry: 1036

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):93247
                                                                                                                                                                                                Entropy (8bit):7.984265393725331
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:3Kb3gvZ07u3Az3WqbRhmTk4KR3LNmiM/Wb2AOAptGaA3n+GNmxejje0u5qCgn/jt:3Tmp7RlhmQ4I3vb2RAan+KIejM5u/p
                                                                                                                                                                                                MD5:BDECBBBA221ED7C2697F6915D57A47C2
                                                                                                                                                                                                SHA1:7388FA5730BA52DAED0258E6FA636AC3EC8434FD
                                                                                                                                                                                                SHA-256:0F968ECA9D77969070E71ADA9770A8DD8E3FE0CB19F67C238D9F1B28A8514F03
                                                                                                                                                                                                SHA-512:D194CF3EDE57E71E432BC7BAF8C79A99613F71BA16F70BEFF09F28A376F55773BB1D0761296EF6169E3A673DA7963070A9A1BF6659D3C54CB2D4E1ADCCD6026D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426514758_346684334496931_2479108951499103510_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=-m2NGTXOtvAAX8nZPFf&_nc_ht=scontent-lga3-2.xx&oh=00_AfBjs-vj_paB1BCrKbEjYuPtbdB0mJduSsuWjAzmiFVEEw&oe=65D2E5B4
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100003d1d0000f0460000584c0000805300003b870000ccd1000013d8000052df000058e700003f6c0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".................................................................................|...@.....A@......A@......@.@. ...P.QTP@.UE.QAB..U.U.TP... P.a.(.....@.. ....@P.......U........@P.PPP..P..@P...P...@.........PX....@..DP..@.@...PPR..@P.A@...PPPU..P...7...Q@.....U.AA@...(.....P.....@..@X.....@..TPQ@.@.A@.....P............. ..P..P...P.a.....P.P..PQ@..@P.P..PU..C ..@X.P.. ..@..EP.P..@..E..@.P P.@.P......@..P.......QP2@......E....@.a.-.`..........@. ..U.@.P)U...P.PQB..P....$..@.P....x}\...>.......!......./.wA..p.r.....2.!...p...r.9.....J..q'l.J..qGh.Y....Y...va....no........E...|....wp.>G.....y..G.xS/...X....N...`..<..5y..<g.?h!...?........:...O.C..n."..B.C..y.L<..s.3r..84.

                                                                                                                                                                                                Chrome Cache Entry: 1037

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):121101
                                                                                                                                                                                                Entropy (8bit):7.985919188882698
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:fK75Vtg+KbbmpcwI6zwGtqsMr7vqndIyBT:fKVVtsbSpcwI6zwatg4d/
                                                                                                                                                                                                MD5:49DDE5BB056F1F1BAB82FC7FB390C44F
                                                                                                                                                                                                SHA1:8A37093AB580674271CEE78D8C6B8D7EC052EAE6
                                                                                                                                                                                                SHA-256:59B2A336E6FAA9ACA1BFC273FE4432415D13844974EC405F15F083CD74C0FAB1
                                                                                                                                                                                                SHA-512:252039CB5BA430DA4E648BC7C8DBC2105483E3ACF8891CEC7CC0D92365D76CAC04FC0632C4901CBFDDF170ACE6D53806CEF436BEA0F14CC9199C8B8D0C47C04A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/423212590_388440673832585_4182670990453405130_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=ROUwXFNOYAQAX-Dtm-9&_nc_ht=scontent-lga3-2.xx&oh=00_AfA1pCP4LcoUf9_udh0nnuF8p2PYBenfqEXLU6n1n96U8g&oe=65D44898
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000041e0000825f00002462000023650000b7bb0000b9240100ec2a01001d2f0100123401000dd90100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................U.h.........`...'.S..d}...eVu.;..:..&.U.9.9.,.{;C>.U.C.O....<..|.../.....9....|g._.../F.OO...L.z.7.<....0y.s.>..3.mF.[k7Y.......9#k.s..;.....@.Ag.{=..O2:....z9d..\.3.8.m\.a..!v..*..#........E.}....W..~x..m.....4.....L.U..{.tt.1q.._.7..s.;._/...{~.......3.Eg.j.l.qL.g314..mPz..n....1...S..g.N..u.9..I.l./^r".U7S..L].E..-..&v..y-....i....................BO[7.4...U...?T..Nn......5.L.e....?..9....[X..U.wt.Z.&c...'....ur^..i.e}.Y...X.O%.j.l..".._G...'.;._S.........y.yn.......t..KQ._U.f#..t_......Z.5.....K.\B..<.........q39.....3...71._..uzKtq=.I...{..^....}(.&...l.=.*......5}.

                                                                                                                                                                                                Chrome Cache Entry: 1038

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1728
                                                                                                                                                                                                Entropy (8bit):7.118235449022121
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gqCgpHlc1splJUm43pe6ZAec/c5GB0iYv8NV9WfURlVz/QWPd6Z4ust7j:gXIHliWMmSpzZ3c/dqi5YwQWPdjplj
                                                                                                                                                                                                MD5:7383C89D0F4DDBBDE66A8E3D43C8AFEC
                                                                                                                                                                                                SHA1:1506A356F59D6353764A3C3F8FED2024C46D58B7
                                                                                                                                                                                                SHA-256:3EE64E13C954FAA265DC325A15544DF8CDAA535B94ED8B7C801D33E24EC79DE6
                                                                                                                                                                                                SHA-512:C98C882DF702DA83FFFED7C08B48E2A56B1DA24224EED8CAB27C31033E9288FD8C8F426490EE5DD26A839C2DC689A8942E147F70F64E03A8B88305A00C76747F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/427849903_903358035123096_5320782821649912662_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=cOuHLAz2iFgAX8-ieXC&_nc_ht=scontent-lga3-2.xx&oh=00_AfCWcVbznNYLYk7P0ocw1xPun--CRF8MM40JXZv5NKA8EQ&oe=65D47008
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000e101000071020000b002000003030000fe030000d20400000a0500004e05000096050000c0060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."................................................................................u..O.H..6I.v. ....ja.....Q.Z4...I..*....egIh..2j.^.4 ^@.....!.............................!$............v..y...z.."....}....:hQj...\...}cU.,.{....[..q.7...?..(.'t.>L.6..}..M._E..D..1...n..R...;.<..............................!"A2........?..!..Fj0.U.6......o.^..............................1Q"........?...L...q.Y..9>.B.Se/M~.,............................1... !"2AQBa.....Rr..........?..d.|....1.....&.0...l.[@.....l.rP%..V.r.&&fc.......H..7..qe-:."Tf<....T.Da.=G..VL....p..uW..nX..T\...=].Q.....k.q.$.C..!^....j:..xR..".a....mV[........~.J.....n[...}...C.y....@'w.....)Q.=........."..........

                                                                                                                                                                                                Chrome Cache Entry: 1039

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (4260)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):563567
                                                                                                                                                                                                Entropy (8bit):5.552394223811843
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:l/qymer5YlTk9mfEI7nMGzSjVXD9zld0TV0:vK3SjVRbD
                                                                                                                                                                                                MD5:020E57BF775A025EE4C7A3A8E8FF4B2A
                                                                                                                                                                                                SHA1:E4E56A3F44C1AB9331BC41656DAB877DA0B3655C
                                                                                                                                                                                                SHA-256:050A8B8651E70EA3CAA109922D50FFFC1ADAC87D5F0DA84C16038F8B8DF9EC61
                                                                                                                                                                                                SHA-512:68FD2E712BF3874A81B199C0A0565DCFF827A6AF5EA96A4B30E4D0CEDBC2485E347BC0B6A81CE618BC99A7549958EA8FB4F914DCE1C1606CE6F18E35A24F990C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ii4m4/yt/l/en_US/aa66Uwps2hn.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometLogInHiddenInputs_data.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a=[{alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"value",storageKey:null}];return{argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometLogInHiddenInputs_data",selections:[{alias:null,args:null,kind:"ScalarField",name:"prefill_contactpoint",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"prefill_source",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"idd_user_crypted_uid",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"locale",storageKey:null},{alias:null,args:null,concreteType:"LoginNameValue",kind:"LinkedField",name:"lsd",plural:!1,selections:a,storageKey:null},{alias:null,args:null,concreteType:"LoginNameValue",kind:"LinkedField",name:"jazoest",plural:!1,selections:a,storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"login_source

                                                                                                                                                                                                Chrome Cache Entry: 1040

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (2036)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):39877
                                                                                                                                                                                                Entropy (8bit):5.396884329936008
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:uwoR/ZrQgcREIb+9KiiqR12623vlpOeO/hpoLpRX:uz+gcRhQRIb9AP/hps
                                                                                                                                                                                                MD5:EB4FBC0E01EB4A539A6BC202AFD4C644
                                                                                                                                                                                                SHA1:1798B96F94E4461C211A1E5118994F6E0DFD53BE
                                                                                                                                                                                                SHA-256:ACAE96AA93E083C150D041E2F01185932E5AACD71E4B433CD165DD41AA97103A
                                                                                                                                                                                                SHA-512:B608780ED207A42DBE9DEEE88400A6D9462029A653CEC42323490B7023F210E99FB38BE5574A451F069EEB5A7F8125505989B331A2243C56D1F2C84A74A2B371
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/spf.vflset/spf.js
                                                                                                                                                                                                Preview:(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof l&&l];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var da=ca(this);function ea(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.ea("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.protot

                                                                                                                                                                                                Chrome Cache Entry: 1041

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):216
                                                                                                                                                                                                Entropy (8bit):4.947192163768535
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4mqUEUKFI8iyNd1LkBEo8:t4noU/vmREaI83O8
                                                                                                                                                                                                MD5:FAF3B1C051434D1FC1CFC3335A1015AF
                                                                                                                                                                                                SHA1:A04C68D74A3CCD626617EFEC131D004F4594EF53
                                                                                                                                                                                                SHA-256:C32E7D6B3FC895BB9D822E322CD3D39C49CAEFA647E4FABFC3DD8926FAEB89A4
                                                                                                                                                                                                SHA-512:23BDBD1C69E5B225A417646E742D7F238D7E311A17C866CE563CC82791054CF065F7C0CCD0970E8CAF75A340F1D3D5164BE257578BBE0AC0E8C15A2BCF862022
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/clapperboard/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM18 9l1 3h-3l-1-3h3zm-5 0 1 3h-3l-1-3h3zM8 9l1 3H6L5 9h3z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1042

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1717
                                                                                                                                                                                                Entropy (8bit):7.100470194934129
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gqjxBGwyc1spONvHhmXTL3rUJq6dOHBCrJk8OCH8TvmN1VblcLfz0nHDDBV:g6xBoiWON/gIJqwQPcHnNTb+fwHDDX
                                                                                                                                                                                                MD5:1CE13CB7C14E336921E087CDD19D6832
                                                                                                                                                                                                SHA1:7A9629C59422202E62A8C17FADE4099803EF1157
                                                                                                                                                                                                SHA-256:2AD5330F3021BC774D0F7E5BD16201A8F0B9AEA8EEF07ED2D46DC61C899791D8
                                                                                                                                                                                                SHA-512:59E9EF7F01C8D9DE8DF317A874F31A3A8E61C359AD0D634196FAD32A84878195106DCE2D330BEA85192ED49F532928EA1C3C80FDEE1D8216047DCBF71AAC4BBF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/412493935_678889787689743_6757063533855595416_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=IDFMigjkjvIAX8Fe4xf&_nc_ht=scontent-lga3-2.xx&oh=00_AfDmEKq5NQbal-y6juf6yQMUDjnITCxY3hJn1bn2Vq4qng&oe=65D43B92
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000ec01000089020000c902000024030000f0030000b1040000ec040000380500008a050000b5060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."................................................................................S.:.6...Z..t......5.s:i...^v.hY...v.[d.Lv...._..F........y....Iy.6....!.............................3!.................b....:...<..6D.Dr.......6.W..X..y..T.).w...u..<Y.a....X..)...!.^.KG.X....I.vn..P.0b:......l"3TS.............................!.12AB........?....Z-6.#..4..O.)q.... .........................12A.!........?.D.q....6&%5%.'.`wd...U..P.b^y.OA......*.......................!"1AQ.. .aCRqs...........?.R..Q...N ...|.opo.8.E2J.......#..Ba...o.$...M.).2 0......i=...@.M.C.e\.M..k..d.\.xT\..~...."=.......s]t..~.&.A.Qm!..../..t.c..j....66..........?...#....................!1Aa.

                                                                                                                                                                                                Chrome Cache Entry: 1043

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):111
                                                                                                                                                                                                Entropy (8bit):4.980379097367065
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5KVErcHgDXFUVLUJRVFiAdFUvuII9rP0WTC:tI9mc4slmgSVLU9FRF0ul5TC
                                                                                                                                                                                                MD5:7A85DE03D089077BC1F895B1EA91907F
                                                                                                                                                                                                SHA1:B86AF0404FED40A12228084B3B090DF8DBE50C0B
                                                                                                                                                                                                SHA-256:179FAF7C791CF27682668324B60182039191B22B3AC85069C8BEBBA418DB9A1D
                                                                                                                                                                                                SHA-512:8669E2B41453760B0C67C0701C4EFB4DCF6F544FDB84259383B5E9C64DA4E99DA37CDEC717ECC02E7BB919390E8187877EA125C367456C94B0245BD04E7FB4D4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/keyboard-arrow-up/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 1044

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):6953
                                                                                                                                                                                                Entropy (8bit):4.97426625305529
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:c3q9R1ETjY1k9kudJQphE2HcjHVSdDtIYIsFsiLQ96ziV:r9zEfWWkwJQphjHgkvIYJi0QF
                                                                                                                                                                                                MD5:645F01C1901427F176085F2F984C6139
                                                                                                                                                                                                SHA1:AA5E66A1B49B4840EF30B765712178DA237CD74A
                                                                                                                                                                                                SHA-256:18D91A4732D34F80E3B785F0EE2F3FA5102582D5DA3BC44C76AFBCF87D5E4A50
                                                                                                                                                                                                SHA-512:6913F0471E4510FC5B95A7317C2347B6B5835973BBFC5F51A28A9EC6AF2A29D67BEC4B4B1A434A19610F75A8547C584582FC690E5392B466D534EB5876BEAEF2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/no_input.mp3:2f7009532654ce:0
                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..`.................................................@..................................%trak...\tkhd....................`.................................................@...............mdia... mdhd.............D..`.U......"hdlr........soun.................wminf....smhd...........$dinf....dref............url .......;stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts...................(stsc...................................tstsz...............................................................{...q...h...d..._..._...W...^...b...U...K........stco...............|....udta....meta......."hdlr........mdirappl.............oilst.....nam....data........cancel....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 0000

                                                                                                                                                                                                Chrome Cache Entry: 1045

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):15552
                                                                                                                                                                                                Entropy (8bit):7.983966851275127
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
                                                                                                                                                                                                MD5:285467176F7FE6BB6A9C6873B3DAD2CC
                                                                                                                                                                                                SHA1:EA04E4FF5142DDD69307C183DEF721A160E0A64E
                                                                                                                                                                                                SHA-256:5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
                                                                                                                                                                                                SHA-512:5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                                                Preview:wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v.*.7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....|...H....Fk.*-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..|..d...|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

                                                                                                                                                                                                Chrome Cache Entry: 1046

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):29
                                                                                                                                                                                                Entropy (8bit):4.142295219190901
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:lZOwFQvn:lQw6n
                                                                                                                                                                                                MD5:1FA71744DB23D0F8DF9CCE6719DEFCB7
                                                                                                                                                                                                SHA1:E4BE9B7136697942A036F97CF26EBAF703AD2067
                                                                                                                                                                                                SHA-256:EED0DC1FDB5D97ED188AE16FD5E1024A5BB744AF47340346BE2146300A6C54B9
                                                                                                                                                                                                SHA-512:17FA262901B608368EB4B70910DA67E1F11B9CFB2C9DC81844F55BEE1DB3EC11F704D81AB20F2DDA973378F9C0DF56EAAD8111F34B92E4161A4D194BA902F82F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.doubleclick.net/instream/ad_status.js
                                                                                                                                                                                                Preview:window.google_ad_status = 1;.

                                                                                                                                                                                                Chrome Cache Entry: 1047

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):157
                                                                                                                                                                                                Entropy (8bit):4.866482514263467
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHLLWQlXI1/ymUwHMQMQtnQSb8:tI9mc4slhohC/vmI4NXa//1RtnQo8
                                                                                                                                                                                                MD5:C62423FDC7866B06AF4889BE619900A2
                                                                                                                                                                                                SHA1:93BEEE6DEA1F9CB906B794F182949F357AAC06D0
                                                                                                                                                                                                SHA-256:C47564ECC26A15C0A2381733FBF821EDFDCC17A4A8B946380B6308C6381517DF
                                                                                                                                                                                                SHA-512:4E7CFB526D804C30F4DAED59EA03709BF9D311BF4F30FC090F4032B9C8D12E73789798BD5A5A5AFBE889B009A1BB12E7939577055FC983520E7F93334DABD5EA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_down/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m18 9.28-6.35 6.35-6.37-6.35.72-.71 5.64 5.65 5.65-5.65z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1048

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                Entropy (8bit):4.519025420255455
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4sl5RINAvxm6lzjQewRNGBvLl1ZX1i0dTnUMSdR+trpYmQkDEJM:t4vqNAJXpQewC5pDpU6VYFG7
                                                                                                                                                                                                MD5:DDABFA57FD16BDBA85E2FD30B2B0FEFF
                                                                                                                                                                                                SHA1:9FC8CD1D34223C54E0C86922F2DE68AACBE6E57A
                                                                                                                                                                                                SHA-256:B60F66156BC26031D7F02CC7CAAA6D7277D56F1821ED55280F67446AA3643640
                                                                                                                                                                                                SHA-512:1AD6D890CADC461D74821065143FBE1AFC882C106ED646F41CB2BC12D00D6FCC6E9C68C7FAA7F260F2FABAFF68689EA0DF48CEA54FF40AF505B4A632D67F1B5B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/refresh/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path d="M13 9v2h7V4h-2v2.74C16.53 5.07 14.4 4 12 4c-2.21 0-4.21.9-5.66 2.34S4 9.79 4 12c0 4.42 3.58 8 8 8 2.21 0 4.21-.9 5.66-2.34l-1.42-1.42C15.15 17.33 13.65 18 12 18c-3.31 0-6-2.69-6-6 0-1.65.67-3.15 1.76-4.24C8.85 6.67 10.35 6 12 6c2.21 0 4.15 1.21 5.19 3H13z"></path>.</svg>.

                                                                                                                                                                                                Chrome Cache Entry: 1049

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1210)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):78646
                                                                                                                                                                                                Entropy (8bit):5.412136972940148
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:w/Q5Up0BWTFRcxRpIoMwetxBJ9YDf4YRPlF/hyqqR4Qj2W:87mM1OxAx
                                                                                                                                                                                                MD5:908E3A26A43D87BAC9396377A9C4B6A8
                                                                                                                                                                                                SHA1:B9DDB61F1D0A4ED930881B909D3A4B01B2E62C7A
                                                                                                                                                                                                SHA-256:417FD55B390293D45901B37398ACFC8C3B4FEDE6A395F541C2EE48F732990D61
                                                                                                                                                                                                SHA-512:4FD58BA30456F96A8704412123BCA4C4A48E976E28BAEADED37232FA7A3C4C3FBAA6B79988DC7190D569D1B6024FB0C2F3EAD621A3E2D280C024D7EEC01011B6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/webcomponents-sd.vflset/webcomponents-sd.js
                                                                                                                                                                                                Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}function q(a){if(!(a instanceof Array)){a=p(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b};/*..Copyright (c) 2016 The Polymer Project Authors. All rights reserved..This code may only be used unde

                                                                                                                                                                                                Chrome Cache Entry: 1050

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):346
                                                                                                                                                                                                Entropy (8bit):4.782195104649308
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4eTgAV99WTc6XzQuJ3/vh7QrB9TzUuM8XGk+LlvDME:t4noU/vmRSgQ9Ec6jhJ3XtuM8sL9DME
                                                                                                                                                                                                MD5:A81BADB0BAAD5A9F30C4F71D94F2C09A
                                                                                                                                                                                                SHA1:74DEBED4DAC92DB3B79CCFA1BDD2C93852D2A2B4
                                                                                                                                                                                                SHA-256:C46134C020CDF3060355F81622A054C9F23A4F04AA887876851796FA6243C80D
                                                                                                                                                                                                SHA-512:1F3975165382775F332EE96ECD6BBB06952D583E72E75DD3984860C932D0D88FB04B182842C3F3318455A322F6E01B7C50A0C0C46E861D45542A8F25CC03F9B8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/bag/v4/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M16.9 6c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44-1.73 2.01-3 3.87-3zm0 11c-3.31 0-6-2.69-6-6h2c0 2.21 1.79 4 4 4s4-1.79 4-4h2c0 3.31-2.69 6-6 6z" fill-rule="evenodd"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1051

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):15344
                                                                                                                                                                                                Entropy (8bit):7.984625225844861
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
                                                                                                                                                                                                MD5:5D4AEB4E5F5EF754E307D7FFAEF688BD
                                                                                                                                                                                                SHA1:06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
                                                                                                                                                                                                SHA-256:3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
                                                                                                                                                                                                SHA-512:7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                                                Preview:wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h|.l....A....b6........(......@e.]...*:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#*e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.*UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...*$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf*.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed.*.'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

                                                                                                                                                                                                Chrome Cache Entry: 1052

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):473
                                                                                                                                                                                                Entropy (8bit):5.240157994693449
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:kxeXjxeX4wFbcloiHKobO4xMl23ZhVgBDKDi7e8kbRNfeX60:kMYDRiqobPxi2fVgB+XprGJ
                                                                                                                                                                                                MD5:13782B3B1A5B6B82B186225398C96C55
                                                                                                                                                                                                SHA1:AA9E89FABF00C27173190096499F47FAEE56C684
                                                                                                                                                                                                SHA-256:1EAF3863ADA2FC1BC5C99F0731313B8046C576403EC8721757F935B8245C2C26
                                                                                                                                                                                                SHA-512:D966BA31E97827381C2F26E9DC069A6DA26EFFEE26AE9C1965A73C1CFB4A852A6F4C94BF60B1F33719A3AF522CA0B868D99833E422FDEAD8644BD527118AE685
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=XiNDcc"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.HIa=_.y("XiNDcc",[_.Nna]);._.k("XiNDcc");.var DI=function(a){_.J.call(this,a.Ha);this.aa=a.Ea.ez};_.B(DI,_.J);DI.Ba=function(){return{Ea:{ez:_.CI}}};DI.prototype.kB=function(){_.b3a(this.aa)};_.K(DI.prototype,"IYtByb",function(){return this.kB});_.M(_.HIa,DI);._.l();.}catch(e){_._DumpException(e)}.}).call(this,this.default_AccountsSignInUi);.// Google Inc..

                                                                                                                                                                                                Chrome Cache Entry: 1053

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1738)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2477
                                                                                                                                                                                                Entropy (8bit):5.4374502845572525
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:YzcIe4KH/M/TD6CUvU3vpfKYriTFQsC02Ec3b9:YQ9H/Gf73xnWTOecL9
                                                                                                                                                                                                MD5:B4948C7BFE2D4AEBD9EB3AEABC909110
                                                                                                                                                                                                SHA1:935F743DADD2E5AE5C65D0E8BB1092430AB5FA26
                                                                                                                                                                                                SHA-256:67F059105C4A6782057AB478BFF9135A681CD951FD6203DF096FA2A4E8663E9D
                                                                                                                                                                                                SHA-512:986B28DD77EE735F3BBAC57B45594053D0AEA8CE9E5CD6837DB5CE4446ADD9C768458D0F84FFAC5441A370FF16829490827175420589CE93AA5FC9BAEFC099D0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/_5vDGAzPQ3H.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("Qe2JsExposureFalcoEvent",["FalcoLoggerInternal","getFalcoLogPolicy_DO_NOT_USE"],(function(a,b,c,d,e,f,g){"use strict";a=c("getFalcoLogPolicy_DO_NOT_USE")("1837559");b=d("FalcoLoggerInternal").create("qe2_js_exposure",a);e=b;g["default"]=e}),98);.__d("QE2Logger",["Qe2JsExposureFalcoEvent"],(function(a,b,c,d,e,f,g){"use strict";var h={};function a(a,b){B(a,(a=b)!=null?a:"",9)}function b(a,b){B(a,(a=b)!=null?a:"",9,!0)}function d(a){B(a,"",4)}function e(a){B(a,"",32)}function f(a){B(a,"",32,!0)}function i(a){B(a,"",54)}function j(a,b){B(a,b,3)}function k(a){B(a,"",5)}function l(a){B(a,"",5,!0)}function m(a){B(a,"",31)}function n(a){B(a,"",98)}function o(a,b){B(a,b,7)}function p(a,b){B(a,b,55)}function q(a,b){B(a,b,17)}function r(a,b){B(a,b,25)}function s(a,b){B(a,b,8)}function t(a,b){B(a,b,22)}function u(a,b){B(a,b,27)}function v(a,b){B(a,b,0)}function w(a,b){B(a,(a=b)!=null?a:"",89)}function x(a,b){B(a,b,60)}function y(a,b){B(a,b,90)}function z(a,b,c){B(a,b,c)}fun

                                                                                                                                                                                                Chrome Cache Entry: 1054

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2018
                                                                                                                                                                                                Entropy (8bit):7.70575350679651
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:H/Xlu+QukvxO6/ZvTpbiT2dp/ve+dTzIqbQOa87Mdvieyod:H/XjTyZ80tWOTz988si6
                                                                                                                                                                                                MD5:6383D69B31473C20635A6E26110D80CD
                                                                                                                                                                                                SHA1:2CE39F3C2A505514633984A2279F85A19768784E
                                                                                                                                                                                                SHA-256:DA4D926084BEA6140C81E135D563243A6E7921070163AFD27AD33F2E0B90BCB8
                                                                                                                                                                                                SHA-512:680EC4C9CE26B43711C3209D85BA6F08153AEC0D36BA604BA2F436A4D0AF5D945DB9EFF578BFE8F5D6805C27397F6EC62480124020B5FFC39E461539F2EEFB73
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/Uwbml6dRsBB24x9ghyUXz6ei4-n-0yfPtbcE_EF5kqWOmJvwSevyMebdFWZbPX6OFe7TusN7EIQ=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D...........................................4.........................!."1...AQaq.#2......B..3r................................1......................!1Aa...Qq..."......24BR..............?....m.Y@..}.,.aWS..+(.3@~.#.+s.......R.'.oQ.?#.i#..X.b./..^....,....z7...-`...=H.m.k......q=..:..T..mOn...t........Ak..h..`..F...Q&.`...B.....h....'..,dy....fK..L.m\v.:......[..Kz.k.x.....G.,.k..-.....O%.<..$`...t.W.^D........U.i.....U..6 .%V...H..0..V..Y`..A.B1j....Rx..R..\4.K.u0......e..P+..4Sr:$i"...(.#.KN.4b..o^...l.69.MO>.R..$HR+.......J....Q...<../..8..i.h.&.....z..F+2....+.....M...*U.H`/.\.q.;<....,.P|Q.X.kO.d......H......Fcp.o..D%.F..8..3.J........k.A.6....."V.Gv.......,..I..SOO...e>...7..@...T7z.hK+.|b.H.O.O...b.V...F{`.R8s.H..P.4..Ie.DA*ZYu.'bK;..X....5.?.|..3...T.0#zJ.Fh..A...WbV9^T.%..!.U.h..)w...R

                                                                                                                                                                                                Chrome Cache Entry: 1055

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):163
                                                                                                                                                                                                Entropy (8bit):4.900439585813596
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHMwYSf104XTIUGnYRt8n+R9ZK/:tI9mc4slhohC/vmI4NX104XEUv8
                                                                                                                                                                                                MD5:5D73D2DFB1BEA872F0CEB93909FE6887
                                                                                                                                                                                                SHA1:DEF95E494B458D0E5B4BC0B082AB6C791216E932
                                                                                                                                                                                                SHA-256:EB908A46A75151ADC11154E759DB9BE111AFC67CDA5317AC26B43E3654FD4BD7
                                                                                                                                                                                                SHA-512:2F44B65FE52EE707D1696DE15EC18DB38521D5A848C3F9BD1352BF7BC2A8CA07CF28A98ED891D663F062CA952C72F0082ADB556053D827811E638D649E8FCB2D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/list_play_arrow/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22 7H2v1h20V7zm-9 5H2v-1h11v1zm0 4H2v-1h11v1zm2 3v-8l7 4-7 4z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1056

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):616
                                                                                                                                                                                                Entropy (8bit):4.417992592628411
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRRSpPiaYjmnjdCOmwT2IgpEQx5nnQvqsRihtnRm31IEURwpY:t4jU/vtPnYynsrwT/ox5nnSVaZ+IN5
                                                                                                                                                                                                MD5:2E6B195059996451CC198378775A73BD
                                                                                                                                                                                                SHA1:D1F68BBCF0F62130D235D26F30D99BC1891C96AC
                                                                                                                                                                                                SHA-256:77729CACF85AB5D50BEB76F8C66D44DEAEEE396796F6F659CEB5A5AA2B1A8DA8
                                                                                                                                                                                                SHA-512:317D2E52F04F6FE420E5D6D38E849CE9B8E33602191A85954BB4CCB57976FDFFAF85ED654A6D3B58ABF5FB9A94440FA397850AF73D88728B39484BADA0F9E776
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/question_circle/v5/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M15.36 9.96c0 1.09-.67 1.67-1.31 2.24-.53.47-1.03.9-1.16 1.6l-.04.2H11.1l.03-.28c.14-1.17.8-1.76 1.47-2.27.52-.4 1.01-.77 1.01-1.49 0-.51-.23-.97-.63-1.29-.4-.31-.92-.42-1.42-.29-.59.15-1.05.67-1.19 1.34l-.05.28H8.57l.06-.42c.2-1.4 1.15-2.53 2.42-2.87 1.05-.29 2.14-.08 2.98.57.85.64 1.33 1.62 1.33 2.68zM12 18c.55 0 1-.45 1-1s-.45-1-1-1-1 .45-1 1 .45 1 1 1zm0-15c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1057

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1758
                                                                                                                                                                                                Entropy (8bit):7.114978892184423
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:gU3iWVhwidXqREi5ltR+o6RZDTK++/GQS6dWB5ZN:R3tdXqRE2M3DTvw/dWTZN
                                                                                                                                                                                                MD5:57FA1CC358883857873AD00B589F3DF4
                                                                                                                                                                                                SHA1:5E11FF5922E9107CC1A737A7B872F57F88F8396A
                                                                                                                                                                                                SHA-256:7324DFC6BB119D2F67A332498630CC8381F465ABAD64EF4099DB8AB3602C3F4A
                                                                                                                                                                                                SHA-512:D76CB44F0FDEE10E071B150E2CCBE943A6D462B4C3649C3B815250394BCCB25EBAD3A1AACD50AFF749EEB563B1648899AFACD22A3A841F6E03E3C461D5ACAAA4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/278159097_1414826225655515_6053891562715085147_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=NtxXlEmeuwcAX-AfgSo&_nc_ht=scontent-lga3-2.xx&oh=00_AfCnRVOGbbO6zXLPekgpsACiktqimvrO9s5ji59nEkiMgA&oe=65D43137
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e501000087020000c60200000d030000e5030000b8040000f30400003905000080050000de060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...............................................................................l."F..1.{.....BSE....'s.y..X..j.*..<..].d.w0.......L.>@;...%............................1A.!"25..........Q.o..,-^8....h.<.b..L..|.>.....P..e%.gTs.5..2!.X.V...m..u.....H.....\.].?;gb_....o*|...m^..QaCB.e:.\:|....P..{g............................1!2.........?.k$...K..L.>...#{................................ 1........?.....d..FW]........,.......................!1."AQ. #aq.2.C............?.>.....7.......j.=f....=,n.mf5.....,..+.y..j.F.o...l...P....I..U.q..[.e.?........X.cxv......g.v.;...&.u.,/....-..u.....-..W....|...j.;.JZ.....'..S....J......%....................!1AQqa...........

                                                                                                                                                                                                Chrome Cache Entry: 1058

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                Entropy (8bit):4.113377443767523
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:t4jU/vD2M2hhkiDI7XGx8u3eSRNZM2kCC+8Vjb:t/TuhdDj8uOQNrkj+8Vjb
                                                                                                                                                                                                MD5:839C109F573BC61392F5F014B193988A
                                                                                                                                                                                                SHA1:F5D1DFEEA48DFC3410928EB155E6AAB4A4924A39
                                                                                                                                                                                                SHA-256:C54252CCA0B1AA43C5062281D39AA6E845679DDA9B056A5447036CBA8B3725FE
                                                                                                                                                                                                SHA-512:DC99CC192AC95D3E62C7585393304278D4C2D52A109051D8995200C941C1DE4A68A32F09B828F6853EE745BF1CED7E3AB680F9B30E8C7B1FE8F52DD55B79C08B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/gear/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 9.5c1.38 0 2.5 1.12 2.5 2.5s-1.12 2.5-2.5 2.5-2.5-1.12-2.5-2.5 1.12-2.5 2.5-2.5m0-1c-1.93 0-3.5 1.57-3.5 3.5s1.57 3.5 3.5 3.5 3.5-1.57 3.5-3.5-1.57-3.5-3.5-3.5zM13.22 3l.55 2.2.13.51.5.18c.61.23 1.19.56 1.72.98l.4.32.5-.14 2.17-.62 1.22 2.11-1.63 1.59-.37.36.08.51c.05.32.08.64.08.98s-.03.66-.08.98l-.08.51.37.36 1.63 1.59-1.22 2.11-2.17-.62-.5-.14-.4.32c-.53.43-1.11.76-1.72.98l-.5.18-.13.51-.55 2.24h-2.44l-.55-2.2-.13-.51-.5-.18c-.6-.23-1.18-.56-1.72-.99l-.4-.32-.5.14-2.17.62-1.21-2.12 1.63-1.59.37-.36-.08-.51c-.05-.32-.08-.65-.08-.98s.03-.66.08-.98l.08-.51-.37-.36L3.6 8.56l1.22-2.11 2.17.62.5.14.4-.32c.53-.44 1.11-.77 1.72-.99l.5-.18.13-.51.54-2.21h2.44M14 2h-4l-.74 2.96c-.73.27-1.4.66-2 1.14l-2.92-.83-2 3.46 2.19 2.13c-.06.37-.09.75-.09 1.14s.03.77.09 1.14l-2.19 2.13 2 3.46 2.92-.83c.6.48 1.27.87 2 1.14L10 22h4l.74-2.96c.73-.27 1.4-.66 2-1.14l2.92.83 2-3.46

                                                                                                                                                                                                Chrome Cache Entry: 1059

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):740380
                                                                                                                                                                                                Entropy (8bit):5.729920688068108
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:ZA18+tja0OU+uiAlgU/u0rLDmi6Dcga7ciEskOxCoiuNRF:ZTGjvOZArrdciBkpSF
                                                                                                                                                                                                MD5:F98FC311A243467E1323D5CF6E73D4E9
                                                                                                                                                                                                SHA1:C917CCF1F88AA7D74C8CDD4B3A4B5C5270FFA520
                                                                                                                                                                                                SHA-256:86B01C31FAF78C4C275A4CD608DD112C461B7B3553D50129EFED438000D392A8
                                                                                                                                                                                                SHA-512:149022F0DA5D7491E9AE198D3DB033865AE1D0E399A0F0BD98BA3EDE34659461D0042B962D10B4DFD45DD29850C6FE734D6027DE00BE4493B8CAC31B6B401516
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                                                Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                                                Chrome Cache Entry: 1060

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):274
                                                                                                                                                                                                Entropy (8bit):4.691767704613487
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4tSSJhpbtnRm31IE2l0kjMswple9SY:t4noU/vmRtXVtnRm31IEURwpY
                                                                                                                                                                                                MD5:940A3FA042BCA1DB7543B418E574CCA1
                                                                                                                                                                                                SHA1:AF122097171DD4140E913C6DA8D3501819368165
                                                                                                                                                                                                SHA-256:3EB4200488142D98914FD98981C1C3E6F7C600D3A8E249826B5D72721DD6EE22
                                                                                                                                                                                                SHA-512:33D87129671F2FE4AB2055C0CEF5DA1067D900EB73FAF18A430F5124DD7D2B84DEA0308FB60ADFB060EFDDB09E482894758B4180440D6522A3DA0B0AB429F5EB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/clock/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1061

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):56115
                                                                                                                                                                                                Entropy (8bit):7.983316942303969
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:sPdWippJt9iw8wA4i1PMVSU4hy8Qtma7MSguG/fkAdotGk94tgXasWHW:sPIkJXibw5i1u74hnQtG1StV98gXc2
                                                                                                                                                                                                MD5:7BBDBDA617749D85EBE543230AC09FA3
                                                                                                                                                                                                SHA1:9E87F6D05A84DC77D69864046574763A9B1A642E
                                                                                                                                                                                                SHA-256:702353198F8E8073C629D12B11BE47093382D8BF6BDA58ADE80CEA31BEE729E5
                                                                                                                                                                                                SHA-512:3AE230F5DB52C1C304C448A4BCCC5F4920DADB63DCE992990AE77D1E3A365C5A7D267773FCB56B2B729D334C9D536C80AE428E6B0BEBFE4E1BDB53190473F246
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426396160_359732926858703_7436860518635569345_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=PQlqRvCmJTcAX8dC-iP&_nc_ht=scontent-lga3-2.xx&oh=00_AfBVsj603W7h84MOTqAS-aMfM-_1sl4i8GpY6MGYkI0QpQ&oe=65D3D264
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100009820000089430000ff470000034f0000295d00002a840000598a0000e89000008398000033db0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................o...kg"%.....v.r.+....0@..:.m.n.=(,...u.6CA....$2.=......-.Rj.....B.Y..X...8..h....H...*W...\.......I.l#.0..:.l..D.R.:d......F.5#.....Xd.....%8.g\.~.3...-h...@..a..L.R..G,R"..%..............6.4$..+..+.<=.7a........j.GwL...:S>..Y...N..R!A..R&$..i.. ih.R4L.....FH..{...<..hz.*\.k..B..z..))^!,..3.$..i 0...4..1.PL...;...vH. ...4./...a..s].=.....ro..6!...&...#h...2k.Z...r.A..;5HJ.Q.H.%..j.^'..H.a.......w..,...........@y.0 2..C..H$.).2b.........!.q..j.j...K}........<......us..]....#..2...A....b! ..z.9.Z......V ..N.Y....=...?...k......QI.hK^xd..D..........\]6.......3$....J.h-.w..m......e

                                                                                                                                                                                                Chrome Cache Entry: 1062

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (19354)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1222033
                                                                                                                                                                                                Entropy (8bit):5.464218594877084
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:3N6KnfLZL9tN70ykVoItflp5ihQeODmAOAEuHGXlbyC5Z5Jz51n2nh5M7clc7Mom:97AykLt9Xf/DMumXhyCb5ln2nhcQOMS0
                                                                                                                                                                                                MD5:43CBAD3D198EA5E37BCD4931F9BF5F2A
                                                                                                                                                                                                SHA1:9518A91F868A0D25DF3A26A2D314ACDCD02F23C1
                                                                                                                                                                                                SHA-256:8564D7C33D77F17CA812A651038F922122FF04D297661754959847C6B27F84FC
                                                                                                                                                                                                SHA-512:000B420DB943938ED8034A173BC4C67219A394A76A1EC2AE110DD45C4B30A2349EE84BC0CC1125362AACB9D75E2FC9E1444F88D7672359CB1F6F8EDAA0BBC932
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iwSC4/yG/l/en_US/9fSnOmie-oZ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometStyleXDarkTheme",[],(function(a,b,c,d,e,f){e.exports={"fds-black":"black","fds-black-alpha-05":"rgba(0, 0, 0, 0.05)","fds-black-alpha-10":"rgba(0, 0, 0, 0.1)","fds-black-alpha-15":"rgba(0, 0, 0, 0.15)","fds-black-alpha-20":"rgba(0, 0, 0, 0.2)","fds-black-alpha-30":"rgba(0, 0, 0, 0.3)","fds-black-alpha-40":"rgba(0, 0, 0, 0.4)","fds-black-alpha-50":"rgba(0, 0, 0, 0.5)","fds-black-alpha-60":"rgba(0, 0, 0, 0.6)","fds-black-alpha-80":"rgba(0, 0, 0, 0.8)","fds-blue-05":"black","fds-blue-30":"black","fds-blue-40":"black","fds-blue-60":"black","fds-blue-70":"black","fds-blue-80":"black","fds-button-text":"black","fds-comment-background":"black","fds-dark-mode-gray-35":"black","fds-dark-mode-gray-50":"black","fds-dark-mode-gray-70":"black","fds-dark-mode-gray-80":"black","fds-dark-mode-gray-90":"black","fds-dark-mode-gray-100":"black","fds-gray-00":"black","fds-gray-05":"black","fds-gray-10":"black","fds-gray-20":"black","fds-gray-25":"black","fds-gray-30":"black","

                                                                                                                                                                                                Chrome Cache Entry: 1063

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (4626)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):23279
                                                                                                                                                                                                Entropy (8bit):5.407442942896818
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:bBQaRL6CHqNBPWqYjqr70r2vZzJg8qhv2XikJyJpXZ:bzL6CKNBzYuX0r21JRBYTXZ
                                                                                                                                                                                                MD5:F30B2F8B53685B3360B1CE626C979E7F
                                                                                                                                                                                                SHA1:E37464B6EE84053A9F3A6181130DEA9DB6ACD805
                                                                                                                                                                                                SHA-256:CB3389C57BF933F924DABE54DC4E01C69E8929397A9A2E715074E0B04D9B8DF9
                                                                                                                                                                                                SHA-512:5DF2387B3E24A1859DFD34116F11FDA9728B03EB8E3214ECB269390200B778BE57E5AB151B89DF6165DC717B1CCAFFDBC7160EB5C6725B768505869A77BDF0D8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ib3v4/yv/l/en_US/p1mm--A_re7.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometInputWithCommands.react",["CometComponentWithKeyCommands.react","CometKeys","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||(h=d("react")),j=h.useMemo;function a(a){var b=j(function(){var b=[];a.enter!=null&&b.push({command:{key:c("CometKeys").ENTER},description:a.enter.description,handler:a.enter.handler,triggerFromInputs:!0});a["delete"]!=null&&b.push({command:{key:c("CometKeys").DELETE},description:a["delete"].description,handler:a["delete"].handler,triggerFromInputs:!0});a.up!=null&&b.push({command:{key:c("CometKeys").UP},description:a.up.description,handler:a.up.handler,triggerFromInputs:!0});a.down!=null&&b.push({command:{key:c("CometKeys").DOWN},description:a.down.description,handler:a.down.handler,triggerFromInputs:!0});a.tab!=null&&b.push({command:{key:c("CometKeys").TAB},description:a.tab.description,handler:a.tab.handler,triggerFromInputs:!0});a.esc!=null&&b.push({command:{key:c("CometKeys").ESCAPE},description:a.esc.description,handler

                                                                                                                                                                                                Chrome Cache Entry: 1064

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (48936)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):592325
                                                                                                                                                                                                Entropy (8bit):5.292672904495026
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:vofC38sBIGOdhq0yzBB3+UOM7QR8dWbkMJvxHTIXzHZl+14r9L2ucD+XB7b7E9lV:csBC4VH+UjQK28Xz3+1G9aucD+XtmlV
                                                                                                                                                                                                MD5:79FDBD4BBAB26D0FBB803F8A291BCC24
                                                                                                                                                                                                SHA1:3E8F87A6F224D6228CA25CC7153EBC3E02481515
                                                                                                                                                                                                SHA-256:EDA4213A8D6EA3F2B1F115642D4AAE19640A39C9E939EA0104835FF15F69C25A
                                                                                                                                                                                                SHA-512:6ED6FC686315289A483B29184E9B934EF3722773690E31C4659A1AF691E3947C9165D7166E99962D2BB9ABFD9C638DFD048A864C6C4C402762270FA90EB2F2CD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://static.xx.fbcdn.net/rsrc.php/v3/yP/l/0,cross/PQF6PWqL-CT.css?_nc_x=Ij3Wp8lg5Kz"
                                                                                                                                                                                                Preview:form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

                                                                                                                                                                                                Chrome Cache Entry: 1065

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                Entropy (8bit):4.751341136067324
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4TnMvnY0eLZ72LYMF5fcX1FCG/hd9qCWz:t47N9U/vmRjMvQZ7Bcpc/FqCu
                                                                                                                                                                                                MD5:DB10DFA9A782446C2C69099E4CBEBDFF
                                                                                                                                                                                                SHA1:92B57DC3DD3C747BEB1B8EB98D1CBC3D6AE9B7D4
                                                                                                                                                                                                SHA-256:A6BDEE4CE3188A10940EDC0B870B2898CA2E4311836712341546E3CDD08E3971
                                                                                                                                                                                                SHA-512:96499DB26CF175255484317AFC93B2CC96A5D18E235FC67B9ACBBB3E00B46B3A7E1E6C551764EEBB0A48856FFC2DB5DCA1EFFE478BB417B581E89D435A70449B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/search/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m21.24 19.83-5.64-5.64c.88-1.17 1.4-2.62 1.4-4.19 0-3.87-3.13-7-7-7s-7 3.13-7 7 3.13 7 7 7c1.57 0 3.02-.52 4.19-1.4l5.64 5.64 1.41-1.41zM5 10c0-2.76 2.24-5 5-5s5 2.24 5 5-2.24 5-5 5-5-2.24-5-5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1066

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):709
                                                                                                                                                                                                Entropy (8bit):4.22525639505645
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noU/vmRhHmsiPU0BSMmpa8gQL8nJK18IyNzT+OfIXSVHIvEdQF60hRp2BquDnc:t4oU/vgHIBBSMcNgQL8nJKCzN1f/H2uk
                                                                                                                                                                                                MD5:DB14717F8EB9721D86499B6B2C41E379
                                                                                                                                                                                                SHA1:069496D31A0A689D73513F90E5BD72E2843581EC
                                                                                                                                                                                                SHA-256:15308D594C7B489C6AC3F05C0CB895EEF01DC2F0589FF08B3332C9500CDF7152
                                                                                                                                                                                                SHA-512:A089FD02232B9276377DA115205BC35DF666582F3697558E109A660DDB2AA8215DCB5D81CA54DCC2451E8688555B6DC19316C4D4098D12803B6379DC42C78178
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/youtube_shorts/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M10 14.65v-5.3L15 12l-5 2.65zm7.77-4.33-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 3.24 2.53 5.07 1.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-.07-1.42-.94-2.68-2.23-3.25zm-.23 5.86-8.5 4.5c-1.34.71-3.01.2-3.72-1.14-.71-1.34-.2-3.01 1.14-3.72l2.04-1.08v-1.21l-.69-.28-1.11-.46c-.99-.41-1.65-1.35-1.7-2.41-.05-1.06.52-2.06 1.46-2.56l8.5-4.5c1.34-.71 3.01-.2 3.72 1.14.71 1.34.2 3.01-1.14 3.72L15.5 9.26v1.21l1.8.74c.99.41 1.65 1.35 1.7 2.41.05 1.06-.52 2.06-1.46 2.56z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1067

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):287
                                                                                                                                                                                                Entropy (8bit):5.015529132385196
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4sl5RtOU0p4nEVkK+CJ1JrycDQnVkxGjU2ZIvhC:t4vfOADKPn5yB5jPMhC
                                                                                                                                                                                                MD5:64090EE2574D7F41444485BDD8E4A04B
                                                                                                                                                                                                SHA1:D2342EBF52614F1EAFD07BBFDC72E3F65A1963B8
                                                                                                                                                                                                SHA-256:483E819776ECFED148800D9E881C1C72F4279D74264B49A38346C26358EF98DC
                                                                                                                                                                                                SHA-512:E936442EBA58D4438749791365F38CE7D39B7291F3BB032D35FBB4FAED6AF7E14C9CA7D4FC57A62B90A950C3868AF0755C4530BB5DF8A05CA9FC27044BD522C6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/unplugged_logo/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M6,18h12v1H6V18z M22,6.2v9.6c0,0.66-0.54,1.2-1.2,1.2H3.2C2.54,17,2,16.46,2,15.8V6.2C2,5.54,2.54,5,3.2,5 h17.6C21.46,5,22,5.54,22,6.2z"></path>. <polygon fill="#FFFFFF" points="15,11 10,8.35 10,13.65 "></polygon>.</svg>.

                                                                                                                                                                                                Chrome Cache Entry: 1068

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):778
                                                                                                                                                                                                Entropy (8bit):4.260772867505465
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4tM65jghuamzC41gZVz1QDUQ2R6a2qanGgmonPQ/0:t4tMMjwuamzz1gZLQER6lLmoI/0
                                                                                                                                                                                                MD5:C912F19C8AAE23F530DFDDD4D7BBA780
                                                                                                                                                                                                SHA1:40C607FABFDE63E2A4D92462FEC123A2D52D1F8E
                                                                                                                                                                                                SHA-256:E593ED5B1D641EA4F61CD2308346A608EE088E293AC177881E4CB43969B87E05
                                                                                                                                                                                                SHA-512:377D00EF8981C127EB1A573731B1EC22DA072DED23E7D920834C88F280FEFD160885D9EFEF3F8C6B942DB280685ACED73B2D7240ED55FB85947D8180A1FFBC37
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-dislike/v2/32px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M6.15895 20.0023C5.32221 20.0023 4.54031 19.586 4.07317 18.8918C3.30492 17.7502 3.31241 16.255 4.09205 15.1211L4.82045 14.0617L4.14538 12.4963C3.74297 11.5632 3.84031 10.4898 4.40399 9.64424L5.50013 8.00004L5.50013 6.00231C5.50013 4.89774 6.39557 4.00231 7.50014 4.00232L20.0001 4.00239C21.1047 4.0024 22.0001 4.89783 22.0001 6.0024L22.0001 19.1736C22.0001 20.0073 21.7396 20.8201 21.2551 21.4985L16.1368 28.6641C15.9224 28.9643 15.5279 29.0747 15.1888 28.9294C13.4238 28.1729 12.4653 26.2504 12.9234 24.3856L14.0001 20.0024L6.15895 20.0023ZM27 18.5001C28.1046 18.5001 29 17.6046 29 16.5001L29 6.00006C29 4.89549 28.1046 4.00006 27 4.00006L24 4.00006L24 18.5001L27 18.5001Z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 1069

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1354)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):186380
                                                                                                                                                                                                Entropy (8bit):5.512786973993877
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:SYyvr5xyecNdRk3zE63vUWl6oPCOQ5whSWIjKUs7dDmn0v8umA8Qi4UJ7UwOwdwr:SYkr5xek3zEwvUWl6oPCOQ5whObs7dDF
                                                                                                                                                                                                MD5:7554AE17C5023ECC6D0FFC1E8775BC2F
                                                                                                                                                                                                SHA1:37B39540102E29993F710047ED89BBE3B47A3A2B
                                                                                                                                                                                                SHA-256:6101EEA4239DED7503B74732D078DE0DE0E31D9465DE3876B1641802DD299200
                                                                                                                                                                                                SHA-512:32B21C1D58028A46D7B1C67A79F1348DE19C9316B0CE0BF225904686A81033051B51AD06D6E37D41EA281E5A0D547D58D553D3579BEB23115B3715ECF348EBFB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/6y2czwba46q3wsh2b0d0g6trj
                                                                                                                                                                                                Preview:this.default_gsi=this.default_gsi||{};.(function(b){var l=this;try{var Ia,U,u,p,Ja,Ka;Ia=function(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}};U="function"==typeof Object.defineProperties?Object.defineProperty:function(a,c,b){if(a==Array.prototype||a==Object.prototype)return a;a[c]=b.value;return a};u=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof l&&l,"object"==typeof self&&self,"object"==typeof global&&global];for(var c=0;c<a.length;++c){var b=a[c];if(b&&b.Math==Math)return b}throw Error("a");.}(this);p=function(a,c){if(c)a:{var b=u;a=a.split(".");for(var e=0;e<a.length-1;e++){var f=a[e];if(!(f in b))break a;b=b[f]}a=a[a.length-1];e=b[a];c=c(e);c!=e&&null!=c&&U(b,a,{configurable:!0,writable:!0,value:c})}};p("Symbol",function(a){if(a)return a;var c=function(a,c){this.g=a;U(this,"description",{configurable:!0,writable:!0,value:c})};c.prototype.toString=function(){return this.g};var b="jscomp_symbol_"+(1E9*Math.random()>>>0

                                                                                                                                                                                                Chrome Cache Entry: 1070

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.google.com/pagead/lvz?evtid=ACd6KtzBu42M0sZKQbmyebdsYN-xpqS1LfG-DbqLm7CQplVXJ4Ue9fwpTJBtH0daRfz-yLVEXC4F6uJnvsi_tknkXnSy9-rjSw&req_ts=1708035624&pg=MainAppBootstrap%3AHome&az=1&sigh=AB9vU40MUXaIRdddQ4W_BSz8UsiMSV-HvQ
                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                Chrome Cache Entry: 1071

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):320
                                                                                                                                                                                                Entropy (8bit):4.8695017860270475
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4jN9RotqtWIXWkjRBnmHRLmTCSkeLlzIxfIcHTJ+hu5hTO:t47N9U/vmRR9jRxmHRLkCsL9IxflMwhK
                                                                                                                                                                                                MD5:0913F87D10776D31276AD2F0A64D4177
                                                                                                                                                                                                SHA1:EF9EA8B47C6243293A187C61708218B1A1F6E0B6
                                                                                                                                                                                                SHA-256:4EE171268D505E911DA178827E7EF13A9C7EB1D6F42FD12F430B4621465EA834
                                                                                                                                                                                                SHA-512:A583DF01EF03C14B840FB699C36B8591D8386B04D65CAD74E599A4065F1C5456D4974A7DBEF6031E429D2B126A089A582794D78BCFB3F88D91C9394108619D16
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/bell/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.32 1.01 1.03 1.01 1.76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 1072

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):249446
                                                                                                                                                                                                Entropy (8bit):5.470579685220208
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:IVyBYOfI26udxTWTcTEDM2j16TcTEDM2ilGb+UPhHo6CmEMDWwyF:oyBzZ3dNo6CFMqwyF
                                                                                                                                                                                                MD5:3A9B92C1093DEB1F83F57CE9387856F3
                                                                                                                                                                                                SHA1:375489BE5E642B11E62149F791C3DF5C66B6CFBA
                                                                                                                                                                                                SHA-256:F5D13C67089BF5CDBB1B349183598BA8DF4DD95A9CF3187E9FD4172F5F5C36FE
                                                                                                                                                                                                SHA-512:6588C81876AB2B528C71AC29CB950D5894DCD71C546A65EDFE8AA0977B2588DC6A8DF2B8A55470C44427A7E61869C6DF67A79B37A59A3A0847F8689D276AD051
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/3gwr64x0h4e06b6c0wej9hqsz
                                                                                                                                                                                                Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=105)}({0:function(e,t,n){"use strict";n.d(t,"j",(function(){return a})),n.d(t,"x",(function()

                                                                                                                                                                                                Chrome Cache Entry: 1073

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1586
                                                                                                                                                                                                Entropy (8bit):4.971538502379734
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:Yj0jutsEgaFs9v8eY2x2UfwhUdt0A66ucXaKUoXab/:Y9ts3aFs90pUbtd79aKpab/
                                                                                                                                                                                                MD5:052B9F6B80876F7C32894105E377BA3B
                                                                                                                                                                                                SHA1:2018FC66AB3C28A18167B11C547406CF1BBAF89A
                                                                                                                                                                                                SHA-256:A7B005C03E9F79AB0D36080925C50F6C101BBBF9853DD849E9A0030A810C89A1
                                                                                                                                                                                                SHA-512:2DC6CA28250F1E5A0EF91D677A6732BD64D5D09C930B78AF226823621C0F1A6BDBDE23583C75F69D5101E918D7FAF40ADD7C236B0AA733D3B02F95528D1B3374
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/manifest.webmanifest
                                                                                                                                                                                                Preview:{"name":"YouTube","short_name":"YouTube","background_color":"#FFFFFF","display":"minimal-ui","start_url":"/?feature\u003dytca","scope":"/","icons":[{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png","sizes":"144x144","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_192x192.png","sizes":"192x192","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_16x16.png","sizes":"16x16","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_32x32.png","sizes":"32x32","type":"image/png","purpose":"monochrome"},{"src":"https://fonts.gstatic.com/s/i/googlematerialicons/video_youtube/v11/white-48dp/1x/gm_video_youtube_white_48dp.png","sizes":"48x48","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_512x512.png","sizes":"512x512","type":"image/png","purpose":"monochrome"}],"theme_color":"#FF0000"

                                                                                                                                                                                                Chrome Cache Entry: 1074

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2434
                                                                                                                                                                                                Entropy (8bit):4.737059133849761
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:owOGkjKLAltP84lPMYxznNoCGVShuKJpn2:MLvtPhlPMYFNoAJp2
                                                                                                                                                                                                MD5:06360FF211B374AFC9473FAEA2886095
                                                                                                                                                                                                SHA1:6E40EC924C7CA539185ADBF78566DAEFEB5B97BC
                                                                                                                                                                                                SHA-256:EEA10F57C4E2A6677142FEEC3F9353399D500BE403C61C5456881396ADF6FEE3
                                                                                                                                                                                                SHA-512:3F1A3497714CA8C028469439CEF0B1DAE3805B34447CB96BC2C973A7C98F06EE9F75C91D2DC7DB334ACEB7031888727091B9700E1BEFCE71B5C9A431830CEDA2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_round/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <radialGradient cx="5.4%" cy="7.11%" r="107.93%" fx="5.4%" fy="7.11%" gradientTransform="matrix(.70653 0 0 1 .016 0)">. <stop offset="0%" stop-color="#FFF"></stop>. <stop offset="100%" stop-color="#FFF" stop-opacity="0"></stop>. </radialGradient>. </defs>. <g fill="none" fill-rule="evenodd">. <path d="M1 1h21.77v22H1z"></path>. <g fill-rule="nonzero">. <path fill="#F00" d="M22.54 7.6s-.2-1.5-.86-2.17c-.83-.87-1.75-.88-2.18-.93-3.04-.22-7.6-.2-7.6-.2s-4.56-.02-7.6.2c-.43.05-1.35.06-2.18.93-.65.67-.86 2.18-.86 2.18S1.04 9.4 1 11.18v1.66c.04 1.78.26 3.55.26 3.55s.2 1.5.86 2.18c.83.87 1.9.84 2.4.94 1.7.15 7.2.2 7.38.2 0 0 4.57 0 7.6-.22.43-.05 1.35-.06 2.18-.93.65-.67.86-2.18.86-2.18s.22-1.77.24-3.55v-1.66c-.02-1.78-.24-3.55-.24-3.55z"></path>. <path fill="#FAFAFA" d="M9.68 8.9v6.18l5.84-3.1"></path>. <path fill="#000" fill-opacity=".12" d="M9.68 8.88l5.13 3.48.73-.38"></path>. <path fill="#FFF"

                                                                                                                                                                                                Chrome Cache Entry: 1075

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):13697
                                                                                                                                                                                                Entropy (8bit):7.947489683799493
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:ilANNmmuoJ9/z86PvFWhuBBDR+oi1bb/1c8:lNNGoJ53dW4BBpi3/1F
                                                                                                                                                                                                MD5:7848DBA09B5ED8A5B73E361C05FE946D
                                                                                                                                                                                                SHA1:8CB3326E11AF27BE1A4426FF68A0DB448F7737A8
                                                                                                                                                                                                SHA-256:9EEC7103E040E23A36DA810F9283ACFB470354316B8A2DC280C9F4006D4E2145
                                                                                                                                                                                                SHA-512:862AFEA1E20F04BF32C7C351F2EE4B606616530246948681FECFFC65AD453DF0682303C4B73B381A3802979E4D7AD1AF31C78E15E640E439AAC5D30880A55B74
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/424941685_325747306564719_1799820653588699823_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=ksia-ds8J3UAX_5DvJW&_nc_ht=scontent-lga3-2.xx&oh=00_AfBHFAGoSXyZ9eXy5uLEyafgupgP52FWNOH-Wkbg34BNaw&oe=65D3006A
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7001000063060000560d0000270f00005f100000b0150000851f00009c2000007d2200000124000081350000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."................................................................................h.{"...J*.I...U&...Pf9...P....5s.0_.dN.wpy1.;....wu.C.....$.5Z.X.....T...g.4...p.4...a...4Gj..I..T+..R....@F+A9..y......5......r.(Y.}3..}.[.5C....@..5PH..Y.p.6I..rp./...1...szS..9c.9....ky....oU..vJiZ....O.4.V...@.e.n.|."@d..... ."+...W..A....NoS.>^.s.'..V....CR..(..2@...5..F.e.............u.4.w..<..C9..FvG.[.z<.h .L.3.f7p#.....C..}.r.mi&......W...l.K.)'.4....Z....1.....VT.k...Jq..a...Z.....>..MnU.<..v...p...C...k....-`.Nt...6u...l*....q}u.lu./..F...7.HVK.9....N.J...;Y.OSU..=.<.`.*...Y.\..U.#i...-........q...,...R...E.6..{.=..f..Dq.ov..Y.M.U.e.|.Kw....oW...\..u...s..U..F=s

                                                                                                                                                                                                Chrome Cache Entry: 1076

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):338
                                                                                                                                                                                                Entropy (8bit):5.081456518478992
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slbWKJAOBUtTxGjxAOyVov2RtNI8MobBWDyewVR2OsXdfDRUEubz5JM:t40rOQojGOsov2fCy9GyekahDRqzc
                                                                                                                                                                                                MD5:344BD6131BA252992E7B43DB8ACF0EF4
                                                                                                                                                                                                SHA1:AE9762E6C8B2582AC06B72E1056F93394F1E7528
                                                                                                                                                                                                SHA-256:F45C028690DE48FA989AA16E372FA580806B168114800CCCF6BF967C1B73C7E8
                                                                                                                                                                                                SHA-512:49EE13BAF8D5E0847DDC4CE980F33540EE405784432E6027310224290FC1B9D835B80D8F9C7CE02D5A2692411B9B230BE65FF8DF6F63CCD92287D109673C1888
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_music/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <circle fill="#FF0000" cx="12" cy="12" r="10"></circle>. <polygon fill="#FFFFFF" points="10,14.65 10,9.35 15,12 "></polygon>. <path fill="#FFFFFF" d="M12,7c2.76,0,5,2.24,5,5s-2.24,5-5,5s-5-2.24-5-5S9.24,7,12,7 M12,6c-3.31,0-6,2.69-6,6s2.69,6,6,6s6-2.69,6-6 S15.31,6,12,6L12,6z"></path>.</svg>.

                                                                                                                                                                                                Chrome Cache Entry: 1077

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):120
                                                                                                                                                                                                Entropy (8bit):4.568105614797637
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:bh6G3XWZNDrMyMcbtugSUhdei3XWZNDrMyMcbz1h8FfY:bnXS5JtpnS5JZh8Fw
                                                                                                                                                                                                MD5:D101838E73B156A21EA1FD94EBCEEB1D
                                                                                                                                                                                                SHA1:C515B856E4AA0DE6FDAF13536873AFEB0D44D45B
                                                                                                                                                                                                SHA-256:01E64CF9DF1DBF2FB4BFA333E3B2838272081B0BD396AACF340A56FA9252E15D
                                                                                                                                                                                                SHA-512:A13AA569E36F3C68585965FDCC5B54454264E9EE7CB1BAE695EDF70F0716EA6D71D3E0060B39074BD1EA0E5AE9946B8A1CDF80E7A52BEE1DC8CF8E8E2FE79324
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwkbMnFS9SzlUhIFDYOoWz0SBQ3Fk8QkEhcJsA2cf48--pcSBQ14bxIZEgUNxZPEJBIQCXIJePU8PqV8EgUNvYWDDw==?alt=proto
                                                                                                                                                                                                Preview:CiIKEw2DqFs9GgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCiIKEw14bxIZGgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCg8KDQ29hYMPGgYIARABGAM=

                                                                                                                                                                                                Chrome Cache Entry: 1078

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 516x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):182761
                                                                                                                                                                                                Entropy (8bit):7.988432399734946
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:1GWu4GEMVH37GX77o09z8b6Hbk+f5wCA4diThhLVphjUkW+9FcxL:T/DMVHrY7o09UgbBAThRTW+9F6
                                                                                                                                                                                                MD5:2C8D3853727FFC0BA95BD1A68C0DE31D
                                                                                                                                                                                                SHA1:1BF6EC411FDDBE05E34EEF1BDC46D8409802867A
                                                                                                                                                                                                SHA-256:E0A7E91271F71F9E5041A7D1FCFA157323924FAB45FEFF453909C93118F39E4E
                                                                                                                                                                                                SHA-512:B3BAACB1C3EA9A5DEA3D20214E6CDE4C1D4E9DB68A4ED672093FCA5367C510C9507AE1350F2C5CEC305F0C852953A8398DAA78793EE0DBD2E26E0BBB6B6D1E62
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/420280968_974435747584261_275521808879885577_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=fR1PYDYzvVYAX8Oubqo&_nc_ht=scontent-lga3-2.xx&oh=00_AfBeT2ZY5xoBIfGnlXlDE4W9upYsSp-55VwHvHeofkNmLA&oe=65D2B65E
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000891d0000d05f000020620000fe640000d01d0100d0ce0100d7d4010095d9010044df0100e9c90200....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................~...Z..@........m...A..T....8N.f.yJP.6..:...k].u.I.@k..,V....R..........Ze.l..m.-*Pn.y;.p......t.T...:.QY..8.)....d........k..K.FR.r.q..........+.+Z..*.R.z..M*e.....S.i'E.o..!n.&t..d.f..>a..6(.OQ..N.0..qq.VjZ.i..LI.1Q[...R.6Ais...8I+....Y....LFz_.bo......./P.../Z......T...!...^.6o.0..3.+=.z...9..[.W...t.1.."..Z..kV.[.1...:&.V&.Zz..."..&i...^%.!......t,.c.K/..Z.J...X..D.$...../X`..F.h..X&...|..sWU...I........:.S....B..^.+..3z....IX..u.L2E.+..#.li<.1.......g.&tV.r.Z...)........z.e.t..`1..NaR.{&.=..N..yJ6...q.......k.k.^$.....:Lk5...%..7.q..K.[8..B..K}.EfN......Un..cn...s.

                                                                                                                                                                                                Chrome Cache Entry: 1079

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:C source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):75995
                                                                                                                                                                                                Entropy (8bit):5.330233242624909
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:r1X8E9coqS/zCct2GhRPXE2IbD71SgUeW7vIUncTUDgNpD5qTqGUMIzA:N8+/zCct2GDPXE2IbD71SgUeW7vIUncs
                                                                                                                                                                                                MD5:77476E9F4544D16E10921CB9D56067F3
                                                                                                                                                                                                SHA1:22677D2DF42EEC873802245EC72BBD8B6896F324
                                                                                                                                                                                                SHA-256:FB9B509D020C4C45AD497DE7C4F7D1B22B4E7DC62339927FBF7E32E227932CB7
                                                                                                                                                                                                SHA-512:86778E76F67A995D3FD9E4A5A6EDE940F5929A50390D578BD12ABBEEEA8FD94C09C8566C831DD92BB6D13A18ED24CE014416693432DD132207F0972B052C3408
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/727ucpfhmn0jolb3t2h3o5dkj
                                                                                                                                                                                                Preview:var _0x41e7=['platformKey','getNavigatorPlatform','productKey','product','productSubKey','productSub','vendor','vendorSubKey','getDoNotTrack','incognitoKey','RequestFileSystem','webkitRequestFileSystem','TEMPORARY','storage','estimate','quota','safariIncognito','localStorage','setItem','test','Firefox','open','onerror','onsuccess','indexedDB','PointerEvent','MSPointerEvent','IE\x20','match','join','replace','OPR','Opera','splice','canvasKey','isCanvasSupported','getCanvasFp','isWebGlSupported','getWebglFp','javascriptsKey','scripts','locationKey','hash','host','href','origin','signalsKey','getSignals','getAdBlock','getHasLiedLanguages','getHasLiedResolution','getHasLiedOs','hasMinFlashInstalled','fonts','swfPath','loadSwfAndDetectFonts','missing\x20options.fonts.swfPath','flash\x20not\x20installed','swf\x20object\x20not\x20loaded','jsFontsKey','monospace','serif','Andale\x20Mono','Arial','Arial\x20Hebrew','Arial\x20MT','Arial\x20Narrow','Arial\x20Rounded\x20MT\x20Bold','Arial\x20Unicod

                                                                                                                                                                                                Chrome Cache Entry: 1080

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):11930
                                                                                                                                                                                                Entropy (8bit):7.931197392166529
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:5Jz7NDgq/CAB6MQNtQ7rQHQkD3ZFYSa7wRlrBcidYNSIxomKOqFr9V:5JzRcq/CArQNS7rQHVbZ8EPBcidYNSI0
                                                                                                                                                                                                MD5:F50B319F28FFADAEC61A36F233B23D6F
                                                                                                                                                                                                SHA1:62C4FB81C7AA7210672CCC98F8332EB9F23A230E
                                                                                                                                                                                                SHA-256:AE6CF168BC62E244FD462AFACA50C7153B63E560E2A85AC68D82B4A43148521F
                                                                                                                                                                                                SHA-512:0B87CCF3201CB72866BFFC6C397DDBA46A807BBF53BABA5311B1D522F3E022683264F7BD3D541F803A2C2906736634D2E27C8EF11E4D6E983CCCD1BAF781AF97
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426687357_919934989573974_8529454827677520617_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=rvINiTldI_MAX8oqAVX&_nc_oc=AQlwmFotANDvpaDrFJ35PMAn3EzAxvJWPEoIoM2uWMxdKxCtbKT9yiMT-t6xQEWU9RM&_nc_ht=scontent-lga3-2.xx&oh=00_AfBg9FhqzIsYde5SDKCRdNq4JP80nTE9ULL6gCK5MRhrkg&oe=65D41349
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000ec050000470c0000140d0000ca0d000019130000121c0000221d00002e1e00002f1f00009a2e0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................,....0}.._q...E7...r<."...kr.e-Z.w....p..yg..In...YmN.B.rV@@@0...X...A...Z....`.l.....c9|.D)..Xp.....z..4b..X"...e=.JW....L`...!p....c..r..%.~..L.$.p."8.c..>.X1H.G....~.n.....b}#........YU.wX.. .P.\.`x..<}.[.>.k.......^..5-..u..b.....AV8h]......`...oX.,]......J_.7....}h.S.....`J...*[].F.u.g...].M5..n....Z.v..s..!...N9uX.,B.+xY]vWT3.....4.....8.....|..\qQ.].!.d......@...FE-.^W?w.yg..~..35ry..q;.....s.o2XgL.L(....lX.Q.......&.sV.].}9C.....vtL..pr.....p...UJ..,w.....V..A...M..h03.Jf....F;........d.>]...D.i.Y.c../..9........{}/.jT..l.2..wg...r..%S4.(.V.]......<..Gn...5

                                                                                                                                                                                                Chrome Cache Entry: 802

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):175
                                                                                                                                                                                                Entropy (8bit):4.966965284633015
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHtRUhVNBz2SVMzLSQQQEK/:tI9mc4slhohC/vmI4LUhVNBz1VOGQQQz
                                                                                                                                                                                                MD5:36830448E3F7A1A3A2D487003A091E9C
                                                                                                                                                                                                SHA1:5E890C51BC88F472775B79639B6C1FC51F08DC05
                                                                                                                                                                                                SHA-256:31264354C77C510E3AE936076B8C10048515F7F6F5B6EE3EC34FD184144DF96E
                                                                                                                                                                                                SHA-512:D3AA088237953AC48F2E66B6C3DFBB3A18A11F508E2F2DC650596EE5CE5908D2BEDF2AA01107F0A89DC7B113BBF63C2CB71DA113AD6625047707D3C3E4690F5B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/download/v9/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 18v1H6v-1h11zm-.5-6.6-.7-.7-3.8 3.7V4h-1v10.4l-3.8-3.8-.7.7 5 5 5-4.9z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 803

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (65405)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):8507871
                                                                                                                                                                                                Entropy (8bit):5.622274591081334
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:49152:gGabZowULS9QG1/HPCy/56BC+frKeVTNkk5vXHNki/a23ceCAP/bveVhSlwgYfET:OsB1rKstkJe6sWUH
                                                                                                                                                                                                MD5:6D8F8B6984A62FAC0279E98F93180F0B
                                                                                                                                                                                                SHA1:45996079C14E7435C7368BE427A2AC4FBEC7F6BF
                                                                                                                                                                                                SHA-256:5DD00BFB075973E4188F2934DBABA9F8809DF84CF92921A521532BFA1B983D95
                                                                                                                                                                                                SHA-512:56DF5A8AB808A8025A06D34D92A5212E9502CE02C35A190CEB13054B251705ED0438AA4217E450F11CBEDEB8CA11EA2FC2BA128CBF29DEC2BF6DC6B2F6D37738
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/desktop_polymer.vflset/desktop_polymer.js
                                                                                                                                                                                                Preview:(function(){./* HTML content inlined from HTML import */.const d=document.createElement("div");.d.setAttribute("inlined-html","");.const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-background-color: var(--light-theme-background-color);\n --secondary-text-color: var(--light-theme-secondary-color);\n --disabled-text-color: var(--light-theme-disabled-color);\n --divider-color: var(--light-theme-divider-color);\n --error-color: #dd2c00;\n --primary-color: #3f51b5;\n --light-primary-color: #c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n --light-theme-secondary-color: #737373;\n --light-theme-disabled-color: #9b9b9b;\n --light-theme-divider-color: #dbdbdb;\n --dark-theme-background-color: #212121;\n --dark-theme-b

                                                                                                                                                                                                Chrome Cache Entry: 804

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3166
                                                                                                                                                                                                Entropy (8bit):7.820168448790052
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:POWXqMZIze6KAYFGVxW5BOnR1ulVLMTggdG1/P:LXBUeBAjOvyGlxMzdG1P
                                                                                                                                                                                                MD5:DE6602450C8FB926E807451CD661331F
                                                                                                                                                                                                SHA1:70FB8054A3428A433115118A58AE972D803D4F9D
                                                                                                                                                                                                SHA-256:C3E4830102B867C1B7496D12F008B30047A6CEDE1532192C03457AC4B58EEE74
                                                                                                                                                                                                SHA-512:B9D9DEBE09104E577DBF5BA182BA505E7D29207D35DC8D6C63E128BFE7882EB22F7F9809D4C3057E9347FCD72B223F94E54E8B4D1FEDF1E5244F21C585B50BE2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/rxE4ozyZ3ZCOXp42o1uoomsid1WjqmXwdzcbRdbFOAToxkVAUBeJz1IvJHD0tO2enb2RtPgIRQ=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D............................................0..........................!..."1AQ..2BRa...#Sq.................................;.......................!..1A.Qaq."2..BR..#..b..3r....................?..;...e.Ez..?'..xn....<7O.............pa....80..t...A....?.. .8c...B7..v.|.6jHt.S.d.[..P...k..X.RK%._._.I.@T......~...A.x...r.>T%.).%..N..Wn........3.Q...X.F..t..l^..U....J...\?..Z.. .W........Xjc...6..&.t!R.!*b..s.A......n.Q.0...+**.Y..TU...B..H.....t.....)A.*Q`.$....<...!..7.*..}Q..%*O../.U.^....P...y.M\ML..!E?U...Ga.S.>(..L.K._... .N..5..!\./x..Dh..s...J......2...0,.&T..i.At..7..q...>UD....(..4 .y...6 .D~|g........d...B*....I....]..".."..{.x.....)..x....>.~.....NY...yiO....Z.OEf#.o......>N.\..:..'S.......r.<b.*j.-3.X..."....G=.2..hPP<..?{.....*..S..'..pO&Xu.I.X...<..TF.{-.o&bq.2.e....k........*..I.-t.).

                                                                                                                                                                                                Chrome Cache Entry: 805

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (663)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3238
                                                                                                                                                                                                Entropy (8bit):5.387809520815037
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:o7BOsUSmiHXpkgcKmdNQ8jsetptY2PfygpcaNQJpSN9KI9hGKb1iqyBKAErw:oE07udO2F5caNQJwN9KAuezw
                                                                                                                                                                                                MD5:6B5509EDF491407D765B9248417B3F68
                                                                                                                                                                                                SHA1:5380993E0C0CFA67982B78BD17E283625EE0E77A
                                                                                                                                                                                                SHA-256:F9D2DB8058E0E3CCBEA9FEA1551EE4D9ECFDBD010E10A9922B9389CCD2F13F31
                                                                                                                                                                                                SHA-512:EE9962EA56BE934771649D7157CD7D86933EF07C3813D5C5C962E2D3F5DC53D9F6502D9B2BE24B389E7CB48BF458E8A7E5962BC1FCF283381507724FFCC60989
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var $v=function(a){_.I.call(this,a.Ha)};_.B($v,_.I);$v.Oa=_.I.Oa;$v.Ba=_.I.Ba;$v.prototype.YM=function(a){return _.se(this,{Xa:{eO:_.Hj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.uh(function(e){window._wjdc=function(f){d(f);e(BDa(f,b,a))}}):BDa(c,b,a)})};var BDa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.eO.YM(c)};.$v.prototype.aa=function(a,b){var c=_.Xra(b).Xg;if(c.startsWith("$")){var d=_.em.get(a);_.Vp[b]&&(d||(d={},_.em.set(a,d)),d[c]=_.Vp[b],delete _.Vp[b],_.Wp--);if(d)if(a=d[c])b=_.re(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.Lq(_.jda,$v);._.l();._.k("SNUn3");._.ADa=new _.qk(_.vf);._.l();._.k("RMhBfe");.var CDa=function(a,b){a=_.rqa(a,b);return 0==a.length?null:a[0].tb},DDa=function(){return Object.values(_.So).reduce(function(a,b){return a+Object.keys(b).length},0)},EDa=function(){return Object.entries(_

                                                                                                                                                                                                Chrome Cache Entry: 806

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (826)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):8035
                                                                                                                                                                                                Entropy (8bit):5.326159900569122
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:scBpCBhS6OycT4w9uTEs/tQ7x09fih6axjOrFBh/ZQxKY8X2UBYRMwtRdB:/fEw9uQsamojEFBh/WxhB
                                                                                                                                                                                                MD5:FDA114F94E54E698B9F2916A3F0046F0
                                                                                                                                                                                                SHA1:5E14300C2D580CEB721201B14C19A858734EB2D7
                                                                                                                                                                                                SHA-256:0833BBD2F41E11AD56CAD5E1E52CCDAFB40F3ABB8D71CB3C8B777455DFFEA95A
                                                                                                                                                                                                SHA-512:008E7B7CD839C1B3BFBBFBEF6A5046BAE979FE95A5400CA45765EB74E94594505BB62C42A4F289B86D2B525919884B8B807A025C6C9E4FF43399829E201913E5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.qLa=_.y("wg1P6b",[_.Dx,_.Gl]);._.k("wg1P6b");.var m0a=function(a,b){b=b||_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},n0a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o0a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n0a(b,a)},p0a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.zg&&!(9<=Number(_.Gg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a||a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n0a(a,b):!c&&_.nh(e,b)?-1*o0a(a,b):!d&&_.nh(f,a)?o0a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Zg(a);c=d.createRange

                                                                                                                                                                                                Chrome Cache Entry: 807

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):218
                                                                                                                                                                                                Entropy (8bit):5.088157969445009
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4SDJhK+WkjWp2IGLb:t47N9U/vmRWhKdkjs2db
                                                                                                                                                                                                MD5:46911EFE9CA3F93489D0C1927BBD5B98
                                                                                                                                                                                                SHA1:A587985F1FD3DC99B495BCC620E2351F9BAA13E2
                                                                                                                                                                                                SHA-256:B202492060B933CE3BCD93EED56F46AB442C61ACBBA6D4C47921417A06439096
                                                                                                                                                                                                SHA-512:AA70F29C404DF62CCC4514ED432B4315E423FFEF7AB79DFD8985C58909CFA6263EE5F2A8D0A251A4BF0ECB491C9A39D6A6E2A99307A4A75F910530F60633023A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/message_bubble_alert/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M13 14h-2v-2h2v2zm0-9h-2v6h2V5zm6-2H5v16.59l3.29-3.29.3-.3H19V3m1-1v15H9l-5 5V2h16z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 808

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):593
                                                                                                                                                                                                Entropy (8bit):4.524151373929859
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRGtKL62ZG3XcZsRq6JoNiLrRKMszLgWEajiexYNjbv:t4jU/vNKLgXc6RqCKkE+qTCn
                                                                                                                                                                                                MD5:CD203C4E6B3788438827E21F28380A98
                                                                                                                                                                                                SHA1:374FE8D0C91F9C94E8FEDA631E20D11C55E1C9B0
                                                                                                                                                                                                SHA-256:396B1892EBAA72D0874C8D0A3AFB87B803560058D84FAB6A29761A4D6238F8ED
                                                                                                                                                                                                SHA-512:2E4278A0355E84888561BABF3D0FDABD29AEF0FEFDA84199E794D4CBFC6E01FEEA9C0E91F5EC521E0197F1569788FD36DFC2A0F0BC7186A4D805EB8A9763579A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/broadcast/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M6 12c0-3.31 2.69-6 6-6s6 2.69 6 6c0 1.66-.67 3.16-1.77 4.25l-.71-.71C16.44 14.63 17 13.38 17 12c0-2.76-2.24-5-5-5s-5 2.24-5 5c0 1.38.56 2.63 1.47 3.54l-.71.71C6.67 15.16 6 13.66 6 12zm8 0c0-1.1-.9-2-2-2s-2 .9-2 2c0 .74.4 1.38 1 1.72V22h2v-8.28c.6-.34 1-.98 1-1.72zm-9.06 7.08.71-.71C4.01 16.74 3 14.49 3 12c0-4.96 4.04-9 9-9s9 4.04 9 9c0 2.49-1.01 4.74-2.65 6.37l.71.71C20.88 17.27 22 14.77 22 12c0-5.52-4.48-10-10-10S2 6.48 2 12c0 2.77 1.12 5.27 2.94 7.08z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 809

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):219
                                                                                                                                                                                                Entropy (8bit):4.761347757859317
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4T7HVaar7D93JnGLXeSV:t4noU/vmRT70arpUXNV
                                                                                                                                                                                                MD5:366B82D23090B2A9BA414E77922CE82B
                                                                                                                                                                                                SHA1:1EC32038785C0B7E0591E910D0BCB5BDA337F37D
                                                                                                                                                                                                SHA-256:BF44FEFE6CEA80E391078F4DC8DA39A1CC34704B2B88F2D6402E3CA9F6DCFA47
                                                                                                                                                                                                SHA-512:2DD8EE2C7DBD8CD86C99210C733B33CDE0FD32CAF813E55A74E4C007241CC261EF32B3C091924AE735C50D9A4C80E82DCC38FA643185BF0434B57005C5FAC6F8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/check_circle/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zM9.8 17.3l-4.2-4.1L7 11.8l2.8 2.7L17 7.4l1.4 1.4-8.6 8.5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 810

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2], progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2112
                                                                                                                                                                                                Entropy (8bit):7.047761469657794
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:zaHQdOWDiZiWVgCT6VOIHxApYXD1KZxo2D:zawkMihtT6IIypyIZxo2D
                                                                                                                                                                                                MD5:20F21A147861912A000C50CEA4D9A7F7
                                                                                                                                                                                                SHA1:08330E8983F38C89C6E02DFCD58DBBA2C66667D3
                                                                                                                                                                                                SHA-256:341BA54A9D1F297332E8E5EF0002FF8E521DB4042FD3549EB9B95B47022C4676
                                                                                                                                                                                                SHA-512:A7748676E3C50DC5E2F3062BBF383AB0C11F458E52707501BDC1D60135A0E9BE7BC54AA93A5FB8D606DD461EE1757DC2093198144E457EF01092500C2B7E1221
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/305039035_126456863482221_7637771635799875508_n.jpg?stp=c13.0.50.50a_cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=knKqBoKSVvsAX_RTtsp&_nc_ht=scontent-lga3-2.xx&oh=00_AfBscDKTUjqteigOMamIU-IpURpAqRDmb6eoRoaU5X2wqA&oe=65D29C3A
                                                                                                                                                                                                Preview:......JFIF.............NExif..MM.*.......;.........&...........6....Rachel Rodgers..Rachel Rodgers.....hhttp://ns.adobe.com/xap/1.0/.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 4.4.0-Exiv2">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/". xmpRights:WebStatement="http://rachelrodgersphotography.pic-time.com/www"/>. </rdf:RDF>.</x:xmpmeta>.....Photoshop 3.0.8BIM..........t..Rachel Rodgers..P..Rachel Rodgers..n..Rachel Rodgers..(.bFBMD0a000a60030000d3030000650400009d040000e4040000b605000072060000a9060000df0600001c07000040080000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................;.-5}...|.....U..-..i.}.2].u...j.xeo.D..Y,F.....+z;.&..T......$...........................!A. "25.............NUm....

                                                                                                                                                                                                Chrome Cache Entry: 811

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (5311), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5311
                                                                                                                                                                                                Entropy (8bit):4.950469424497734
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:B2cQbeDaksUebwlobsiJtKDUCbO/7p3uyFu7BtumruJbubbugWHxdXW:XOkAxMHwC/
                                                                                                                                                                                                MD5:81B422570A4D648C0517811DFEB3273D
                                                                                                                                                                                                SHA1:C150029BF8CEBFC30E3698AE2631A6796A77ECF1
                                                                                                                                                                                                SHA-256:3C8B38D9B8A3301C106230E05BEEEDBCD28B12681F22FD9B09AF9E52DC08635D
                                                                                                                                                                                                SHA-512:1D4966A88D7CF6BE31B8F53547A12DB92CABB4C05176ABE995C75C8889765EC68B7210C3BE75F60954CEB2938412FBDEB94D4D25DDC927F3A89ECA76A84A9EBC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/cssbin/www-main-desktop-watch-page-skeleton.css
                                                                                                                                                                                                Preview:#watch-page-skeleton{position:relative;z-index:1;margin:0 auto}#watch-page-skeleton,#watch-page-skeleton #info-container,#watch-page-skeleton #related{-webkit-box-sizing:border-box;box-sizing:border-box}.watch-skeleton .text-shell{height:20px;border-radius:8px}.watch-skeleton .skeleton-bg-color{background-color:hsl(0,0%,89%)}.watch-skeleton .skeleton-light-border-bottom{border-bottom:1px solid hsl(0,0%,93.3%)}html[dark] .watch-skeleton .skeleton-bg-color{background-color:hsl(0,0%,16%)}html[dark] .watch-skeleton .skeleton-light-border-bottom{border-bottom:1px solid hsla(0,100%,100%,.08)}.watch-skeleton .flex-1{-webkit-box-flex:1;-webkit-flex:1;flex:1;-webkit-flex-basis:0.000000001px;flex-basis:0.000000001px}.watch-skeleton #primary-info{height:64px;padding:20px 0 8px 0}.watch-skeleton #primary-info #title{width:400px;margin-bottom:12px}.watch-skeleton #primary-info #info{display:-webkit-box;display:-webkit-flex;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-web

                                                                                                                                                                                                Chrome Cache Entry: 812

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.youtube.com/pcs/activeview?xai=AKAOjss1nrwdau8LRCtEZgbAhgA_4zJWepeDfm0miPvEwrpuqyVkXbGx3IxNi9o6nmmNllI9RZot_bz6SvERtymrKQOWt-pJBqzETB4FVbyE2ll_gaxlVMJAaL4XZEf7mEwGBxNOcbBGwQedIA&sig=Cg0ArKJSzOR0CJ99uqQgEAE&ad_cpn=[AD_CPN]&acvw=id%3Dlidartos%26mcvt%3D16044%26p%3D136,96,484.484375,466.65625%26mtos%3D16044,16044,16044,16044,16044%26tos%3D16044,0,0,0,0%26v%3D20240214%26bin%3D17%26avms%3Dnio%26bs%3D1264,1024%26mc%3D1%26rs%3D17%26la%3D0%26vs%3D4%26r%3Db%26pv%3D0%26epv%3D0%26pbe%3D0%26vae%3D0%26spb%3D0%26io2%3D0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0%3D"
                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                Chrome Cache Entry: 813

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1426
                                                                                                                                                                                                Entropy (8bit):6.850673083192433
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gq0axc1sp8XDjO1XJXTe1K1p6GbHUuqg+/qmOSECVWzIiNwBRRl:gMxiW8XkDuGbHUaSiKVnRBp
                                                                                                                                                                                                MD5:254BA4C57A42ED5B551E8F1CB5D80D64
                                                                                                                                                                                                SHA1:67AB9A4BD2195BB98B6DE86D91BADF48FC1426A6
                                                                                                                                                                                                SHA-256:1B49948E8D82A0354C10FE222D588382328BF4BCA6062339AF708D64D5E0AA48
                                                                                                                                                                                                SHA-512:5804487B8D3FA4D4D37B297374B94752F7F02404EDC7B286CD89D3FA0804A77449702301FD0766EDD629EAF20BCF933BAEC7BCD610072C5091260E96352ADFF7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/392944933_357750843433264_4496030553680877032_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=3NHXASkP_-wAX-EPILk&_nc_ht=scontent-lga3-2.xx&oh=00_AfAQs4vErQo3w2a2F9s4gRZSUfY9Iai8N7kwafC3QgiL5Q&oe=65D3B06B
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000d50100005002000085020000c402000067030000f90300003004000067040000a504000092050000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."................................................................................bg^z...R.y....N.....\&..L.,s..@X....^...FZ...M..................................!"...........5&k.y..T42....U......8....D..E...=..o.l.....F.~Y.......)..BM.R.#vF.>K...XDS.............................!0........?...Yo... .~...............................0........?...r.SK1._...*.......................!.1 AQq.."3.#BR..........?....LcE...b.4.Naf..8..n'.......a.L"...].....1..a..HA.-.LW<..YkZ@.....r.=.p8.s.H...j|.}vmm.+..O.g]M.....{i..h......$....................!1AQ. q.a.............?!..$..+|.....K...&%.v.Ov,...K.d.......x.....{..a.'(.t".V.....N..Z.H,m.F.lB...x....CY.L.....=....m....QV.fhG...k

                                                                                                                                                                                                Chrome Cache Entry: 814

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):259
                                                                                                                                                                                                Entropy (8bit):4.710851372205651
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4zmgwDe4btnRm31IE2l0kjMswple9SY:t4noU/vmRzmgw3tnRm31IEURwpY
                                                                                                                                                                                                MD5:AA228455232ACB0A6378FED3354869AB
                                                                                                                                                                                                SHA1:3447461B1713396150ED0DB5067AE45BFE9F024B
                                                                                                                                                                                                SHA-256:1C594744993B086F8C4D3ABE3A4EF2794F1D1BF0D680A354EC0561AFCE427140
                                                                                                                                                                                                SHA-512:CE2D4D2D8204EEB68E702F71D87B56CE970B4ACDF547AB20FA4A8B281C655FF41BC175A7949F6B453D7ED4A7EF8DE28C2B6774A67708DB8B7047DB3DFDFC2991
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/add_circle/v3/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 13h-4v4h-2v-4H7v-2h4V7h2v4h4v2zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 815

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:exported SGML document, ASCII text, with very long lines (1120)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5598
                                                                                                                                                                                                Entropy (8bit):4.293279469529671
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:04JsH5RGMp9UC96s4AJu4m35PznhTJAxfxZN0rDRMW8R0aaQWD3rKivMt:0ai9UCgs4AJ/mpzcNx/eMw1QWD70t
                                                                                                                                                                                                MD5:2FC13E5E6B51277D7A39CD7AD7D14158
                                                                                                                                                                                                SHA1:0C9A5C613E5B853376CF2B96D8501EE5960D09C9
                                                                                                                                                                                                SHA-256:9073602654785DE3537C4AA85E69847A0BDC871F8DAECB053C7698D4AFE8F6DE
                                                                                                                                                                                                SHA-512:A1F8493CFC4F9C619785D9E39F0E9A54420643C3905193E6D5FFD7531184CA5E5B0FE1B43E7307506ADC01CBB397E4A1CCEA63ACD37304360AACAD8FF06D6DB8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/yt-logo-updated/v2/24px.svg
                                                                                                                                                                                                Preview: LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id="yt-logo-updated" viewBox="0 0 90 20" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg">. <g>. <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 3.12323 0.597366C1.89323 0.926623 0.926623 1.89323 0.597366 3.12324C2.24288e-07 5.35042 0 10 0 10C0 10 2.24288e-07 14.6496 0.597366 16.8768C0.926623 18.1068 1.89323 19.0734 3.12323 19.4026C5.35042 20 14.285 20 14.285 20C14.285 20 23.2197 20 25.4468 19.4026C26.6768 19.0734 27.6435 18.1068 27.9727 16.8768C28.5701 14.6496 28.5701 10 28.5701 10C28.5701 10 28.5677 5.35042 27.9727 3.12324Z" fill="#FF0000"></path>. <path d="M11.4253 14.2854L18.8477 10.0004L11.4253 5.71533V14.2854Z" fill="white"></path>. </g>. <g>. <g id="youtube-paths">. <path d="M34.6024 13.0036L31.3945

                                                                                                                                                                                                Chrome Cache Entry: 816

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):15744
                                                                                                                                                                                                Entropy (8bit):7.986588355476176
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
                                                                                                                                                                                                MD5:15D9F621C3BD1599F0169DCF0BD5E63E
                                                                                                                                                                                                SHA1:7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
                                                                                                                                                                                                SHA-256:F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
                                                                                                                                                                                                SHA-512:D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                                                Preview:wOF2......=........t..=..........................d..d..^.`.. .T..<.....|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

                                                                                                                                                                                                Chrome Cache Entry: 817

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):72207
                                                                                                                                                                                                Entropy (8bit):7.984645197211382
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:hMM2mWapbLokaF2ye304ZJgoOiqcTm7MO1J1rlmb8enp:7hWnxAcwC7jDmbBp
                                                                                                                                                                                                MD5:369D108EC14F9E26BE712346AED8FE2A
                                                                                                                                                                                                SHA1:39C3A84D2D707E2904A496058F3FE9AD4BBFBFE5
                                                                                                                                                                                                SHA-256:131A3C5709EC97618AC7D3FA663268139A75F120CC2BA5B042A5BBDC906C667D
                                                                                                                                                                                                SHA-512:C3D3EC6C7DBA61129EEF9C83DF22090D2F270CBC4A89B52CCE4630B9C3788B47B70B85958EFCB7DC068EBA9C85E6F4CF89E6F77408F8CED986B03C45D6839CD6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/410697622_7314426228588626_260630236871619943_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=xtJq4qkjB94AX_yNnfs&_nc_ht=scontent-lga3-2.xx&oh=00_AfCw2UpO0QRpjq01VoNBtKR4Zy00RH8eDvwb1ZpqiALrcQ&oe=65D441CE
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000e4200000694f0000d8560000a75a0000507e000002b3000033b90000f6bf0000b7c500000f1a0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...................................................................................9.h.,...eL.v.Bg.....,......1.{]......e....<..?Ex.A....]...#.9.<.4O5..<.G.3......{.+"y@e....!...H.6.....]].$i.).A'e..HT..H.I.I2.....Q..cz.PL.......#Y.._.....s....{.]n.E~.@..E.....R...gw.%.........J...\....sD.<...qBg22y..\G...*.b&..IY......W...}...v..@8.h.p.93.)[s...C...s...c.KQF}...je....5.t<.p`........j;SI>._.'.V5..&~..t.$.......4.Q.@;..).,<,.:.o..}._....^....e...L=..x..e8t....vE.t...UH.4....G!.....^I..b......3.....x..F.D..s........r......x.L..4.<..tY.S......5.)'@....oE..^.N.D.n....k.........G.W,.\.&.Z./M....wE..u2r.u.pVN.8.k.nx.~[.G..U..]-39..Q.......;x..vN...h..N=..

                                                                                                                                                                                                Chrome Cache Entry: 818

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (574)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3448
                                                                                                                                                                                                Entropy (8bit):5.484698692620344
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:o4Mjf+vi2hHGMmBUJFXtDaD6U81+K/tmbwTnw:0jf4fJLMhkdlah
                                                                                                                                                                                                MD5:C01A82AB927B56E6B5FA01F6CB78D8F7
                                                                                                                                                                                                SHA1:7C612A2A522DDD882C1DE037C38CFD0D05F6272D
                                                                                                                                                                                                SHA-256:11DB1E8D29DE3DA2678D53580C87CF5B9874BF842B7919861DE31FB1ECCA18E5
                                                                                                                                                                                                SHA-512:BE4366035AC2A2764A4557D4011EEBB5A339FA7C2214322F0293D516ACAD2E12CA4E9B6752B0CCE7D1581A17362835AA811EE7D8261D38204383736E1C9C49BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var lsa=function(){var a=_.Pd();return _.Hi(a,1)};var qq=function(a){this.Ga=_.t(a,0,qq.messageId)};_.B(qq,_.v);qq.prototype.Ja=function(){return _.gi(this,1)};qq.prototype.Wa=function(a){return _.Pi(this,1,a)};qq.messageId="f.bo";var rq=function(){_.Lk.call(this)};_.B(rq,_.Lk);rq.prototype.Tc=function(){this.yO=!1;msa(this);_.Lk.prototype.Tc.call(this)};rq.prototype.aa=function(){nsa(this);if(this.Ez)return osa(this),!1;if(!this.EQ)return sq(this),!0;this.dispatchEvent("p");if(!this.aK)return sq(this),!0;this.NH?(this.dispatchEvent("r"),sq(this)):osa(this);return!1};.var psa=function(a){var b=new _.En(a.I_);null!=a.kL&&b.aa("authuser",a.kL);return b},osa=function(a){a.Ez=!0;var b=psa(a),c="rt=r&f_uid="+_.Rg(a.aK);_.jl(b,(0,_.sf)(a.ea,a),"POST",c)};.rq.prototype.ea=function(a){a=a.target;nsa(this);if(_.ml(a)){this.JF=0;if(this.NH)this.Ez=!1,this.dispatchEvent("

                                                                                                                                                                                                Chrome Cache Entry: 819

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):416
                                                                                                                                                                                                Entropy (8bit):4.4998346788589245
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slmOVIhSXX5xkgm2OCOuLQcTVgXF78Q46yAajyBxQkm3nKYKM1xE5LQI06:t4IjEXX1OC/QcuXFYFjyrQw15L2n6
                                                                                                                                                                                                MD5:DEDDD7D24561E4F2792208764242D5FA
                                                                                                                                                                                                SHA1:DA1A06B033CE9F27DD891B49E71FF3269A9F148C
                                                                                                                                                                                                SHA-256:73C8A18F388DF73D60C4AF2CF0700F889AD24D1557F79C63E37E9C9EAFC9C63F
                                                                                                                                                                                                SHA-512:8A738BB011625C122919C4D8216E285A51CDBA0EAEC6EBF1D16CE367312CCB13C8FD61BE1FACE96FE9746DF2F106BB788182F31C2222F7840A7EEC5A9731A94C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-off/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M16.5 12c0-1.77-1.02-3.29-2.5-4.03v2.21l2.45 2.45c.03-.2.05-.41.05-.63zm2.5 0c0 .94-.2 1.82-.54 2.64l1.51 1.51C20.63 14.91 21 13.5 21 12c0-4.28-2.99-7.86-7-8.77v2.06c2.89.86 5 3.54 5 6.71zM4.27 3L3 4.27 7.73 9H3v6h4l5 5v-6.73l4.25 4.25c-.67.52-1.42.93-2.25 1.18v2.06c1.38-.31 2.63-.95 3.69-1.81L19.73 21 21 19.73l-9-9L4.27 3zM12 4L9.91 6.09 12 8.18V4z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 820

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (467)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1883
                                                                                                                                                                                                Entropy (8bit):5.270984374425825
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:o7eM8KL3AiFxglr7iO7S6fg35rCyRWsRhdrw:opL3FxeT7SMJARhBw
                                                                                                                                                                                                MD5:434730EECF5430D42D426FFF04E3751F
                                                                                                                                                                                                SHA1:E6DC1BBDFCCB76D1F45789C0B55E4F9E5725B677
                                                                                                                                                                                                SHA-256:1BFAD0A3BD2AE9BE050D4A66CE800B030E5E33B6048D14FBECF0501A5728E2E9
                                                                                                                                                                                                SHA-512:F68561DF1AF16BE78F48EFA58D836C33246FF8C8ABDE323C9F2217797E027DC99A699ED3856252A0ACEBC601177B78C264F400B56C52B48B500B07BDE76F964E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.gY=function(a){_.I.call(this,a.Ha);this.window=a.Ea.window.get();this.Fc=a.Ea.Fc};_.B(_.gY,_.I);_.gY.Oa=_.I.Oa;_.gY.Ba=function(){return{Ea:{window:_.Oq,Fc:_.uC}}};_.gY.prototype.Cn=function(){};_.gY.prototype.addEncryptionRecoveryMethod=function(){};_.hY=function(a){return(null==a?void 0:a.Yp)||function(){}};_.iY=function(a){return(null==a?void 0:a.rca)||function(){}};_.jY=function(a){return(null==a?void 0:a.Zp)||function(){}};._.izb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.kY=function(a){setTimeout(function(){throw a;},0)};_.gY.prototype.fJ=function(){return!0};_.Lq(_.El,_.gY);._.l();._.k("ziXSP");.var IY=function(a){_.gY.call(this,a.Ha)};_.B(IY,_.gY);IY.Oa=_.gY.Oa;IY.Ba=_.gY.Ba;IY.prototype.Cn=function(a,b,c){var d;i

                                                                                                                                                                                                Chrome Cache Entry: 821

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):42714
                                                                                                                                                                                                Entropy (8bit):7.995855274546922
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:768:INZr9YkkjXeHlVr+LXsVdGDlY/PMlebECnsXQrgpe4RlnWw:INZp/ealVr+LXsVdGDOPjb/AQrl4Rlnd
                                                                                                                                                                                                MD5:BD6B4AEF882590C8806B471A9C20D99E
                                                                                                                                                                                                SHA1:10493FB4F6BD8E8D77532BB45DF650164218FD9C
                                                                                                                                                                                                SHA-256:7D3F2288D6708C1D0C4569C5E438998872C135D7E6D2FD7DE3993869D5CC1454
                                                                                                                                                                                                SHA-512:FBA3CF6CFAB52B87BC2ABD8483F903B127A11CD97848BB7F6C82DA6700B4D3C53CED15D4C793CC21A39C9CA30DA6CCFD41A609AB8983B1B9B9A00B485FFE1E83
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/AF8d72mA41M/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLAOvZnRIV_cDF_YueXMwwqJV5LbKw
                                                                                                                                                                                                Preview:RIFF...WEBPVP8 ...p....*....>Q$.E..!''.I....M.3... h.:...9.`K..].D......~H..><l._W9.._.......7a..t.......8.......#.........?....%.o.#...G._..................../.....?n>........q........._.}..b...I..........w._.._.?....?..W.......?._.?3_........g.?.....o.....yf...<..W....?r....|....s..._...~q|..E......._...?].o.Y........#.........'...on...z.........w?.}../.....o.....O...~..^}........_.?......G...........u..........?.9..................C.../....{.........=.~....]w..y,."`..H..w..J(..u.....(../.......L.)..J;.aEkc.!...oG:.., .......#.(.P./....dL....EpX...l.Sdzx.y...<f2.0.'..z..n+..hn...`..i..{o.I.2Y~...8!.b.]>...>.. .Kj`.(.\....#...Q.q].YY~..wY......+......Y..u&.gC;...?.....E.)..... .... .p.......@.-..Lb.y+y...5.......R:....vU..Zdg......?K11uS.....T.ba...'g.@...v.JhX`.2......./..4...;...{B.M....=K......$..*.~.e..7G..S)...N..u".W...S4h..dH.N.......d.A.-....N....E.of.J.5.WO_...M.>.No;3..x/..'..kP.>M..,+D...53..|X.U?..b.~.B`.?...e{..8..\.Ww.....R......

                                                                                                                                                                                                Chrome Cache Entry: 822

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):579
                                                                                                                                                                                                Entropy (8bit):4.50640845727472
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRprcQLVhjrAY5uiK8KnnY8/4U0wRJIAoZ6iiMUV0TDoc:t4jU/vycQrjrAY3/Kt/4U0OIFoUzTD3
                                                                                                                                                                                                MD5:C0CCA7B6C1295E79FE9BBE405122AC53
                                                                                                                                                                                                SHA1:69C36F5A0F8E20DC556123F6AF6E0B5AE7DBC18B
                                                                                                                                                                                                SHA-256:6151B1FC5DE0D15BEF2AEAC1B8743AD6A54D9BD44FF5C507321450528D212749
                                                                                                                                                                                                SHA-512:82C80A388F7900F73F38DEA8C0AA92D4EFF9D96D99C4BB8821689E041582D8E885EDE4618CD24C802C4ABE599F6E187801D5AB04D4751D062BAEED06551B0185
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/fire/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M19 3.87v9.77C19 17.7 15.86 21 12 21s-7-3.3-7-7.37v-.13c0-1.06.22-2.13.62-3.09.5-1.19 1.29-2.21 2.27-2.97.85-.66 1.83-1.14 2.87-1.65.39-.19.77-.38 1.15-.58.36-.19.72-.38 1.08-.56v3.22l1.55-1.04L19 3.87M20 2l-6 4V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29-.7 3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2zM9.45 12.89 14 10v5.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.23 1.45-2.81z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 823

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):208
                                                                                                                                                                                                Entropy (8bit):5.110480219410639
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4PaVRLUUkJUaBSY:t47N9U/vmRPaVRwUqUwz
                                                                                                                                                                                                MD5:F5C29B3D10DCCAB880085999FDBB6302
                                                                                                                                                                                                SHA1:779A18F5C8FCBA076D1F341DE5F0CD67AFDC7CCA
                                                                                                                                                                                                SHA-256:177CADE5695A4267C5F90F5BA834636B75C32295DF99AC58B1EA1B97068E8058
                                                                                                                                                                                                SHA-512:0428E50266C32E9825071A940FFC85DAA454106931B7E3873C3187D95FCFF97D64088D50344B4B7CAD6DDF1FA4210C1A3BEC39F0F524B73AE31FDB065E5E3726
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/open_new/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M21 21H3V3h9v1H4v16h16v-8h1v9zM15 3v1h4.32l-8.03 8.03.71.71 8-8V9h1V3h-6z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 824

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):749
                                                                                                                                                                                                Entropy (8bit):4.70368920713592
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
                                                                                                                                                                                                MD5:AA920B32443219E3EDFA32DEF5EBD457
                                                                                                                                                                                                SHA1:8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
                                                                                                                                                                                                SHA-256:E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
                                                                                                                                                                                                SHA-512:C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 825

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x270, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):41036
                                                                                                                                                                                                Entropy (8bit):7.995659790636468
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:768:xQGGPBXpeLaE8hGYVb4Q0MsU6ZO93JvrmdRPpHb6jkh+M4VK2zHwxH:2zXoLaE8hZlGU6ZU3JvrYa8+M+7I
                                                                                                                                                                                                MD5:8BB58F773EE28864773C5FAFB9B64EE1
                                                                                                                                                                                                SHA1:F8B4FF4DF75143B4E152B1A56906AFD803CA4819
                                                                                                                                                                                                SHA-256:6D593E1D1BB8DE0FE824063EAC5066E4A009CE156DD55F6AD00B33AABCADD94E
                                                                                                                                                                                                SHA-512:286A6E6FBFBA94E751540189995BDFBD697D0E75608F9603ED6A5312BD536355E6C04DEED3D7BC06FE0E7F8BCA93868FD49D87D8A525CDD9F464F15B3C665BE7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/ScxR3ZTuNSE/hqdefault.jpg?sqp=-oaymwEcCOADEI4CSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLA10vfybpQ8BXuE50TbQwtWbZxzGA
                                                                                                                                                                                                Preview:RIFFD...WEBPVP8 8........*....>Q..D#.....8....;.....`V.4.f.....C...^..n..>.#...@..Y<....~f...?..?...=s.T.o./....g.../...?m.q}.?.z....S....[........g..W..._...+...o....../._...}.1...._.F.e.C.?.?........?.?...<i...G................[.....?.|.v........{=..._.?u..~.{...............q.k.o._.........y.O....................?.?......../.o......G.....#...?.?.?...._...7.W.Os_.?....a...|:.3w..J.Y...$..k..6.9x.:...b.-.../.T......c.N...#.s.=...6..n.LK..-,#*.....Nn..l!2R/..f...V.f..,...."yT......<e.I.EY....<A....k. %<t..RM..sIgv:....T.......?U.n.+. .Lx9.@....j.....R..[N..17Q...L..h......|).f.2$...H..f.G.l.....W]..a./.j../......:._.m........9M../gwx.M.R...#N......A...._..1.. n3>Hm...G..IB...K<...cv......6..e^j.......i...6.sJ....-;v..rh...4.Z.=...]......a,9.Vq...#..23{EJw.7..Gs...O..4/...9?.....p..T....x.....LS.!...V O...g.v8..d........*/..._..).....'U.._.+....ig..1....q.LN.d[TU....vP...q.p{.9i.[..fz.2.I.H..Q... W..<t..FZ.+.7.~'k.._.z.......>/X.......a.

                                                                                                                                                                                                Chrome Cache Entry: 826

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):127
                                                                                                                                                                                                Entropy (8bit):4.930844660349543
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHL1FId/cIS0:tI9mc4slhohC/vmI4spn
                                                                                                                                                                                                MD5:2C360266A09D79360E247507EF3D2D60
                                                                                                                                                                                                SHA1:AC14D7F9042F470FEE0D48B3D9E6EDBC505285BC
                                                                                                                                                                                                SHA-256:A1C7A119AC9C663E0CD98E8BA6992F8B876F19D92252EB4FDFB1AF0594B70061
                                                                                                                                                                                                SHA-512:FEFE8721063067B784D713E43FF5C05928AFCC19ED2BB5B07536F39523B7F3B2C61E8E98EC68F0E8BF8E406262D00F5A77A0A5A7DA07A2D49EF479FF04D2B1CF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/pause/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M9 19H7V5h2Zm8-14h-2v14h2Z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 827

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (634)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2272
                                                                                                                                                                                                Entropy (8bit):5.245754519805549
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:gncvvcrIt0U+D/mntIsnzIozJP0cCaTa0g/CvWxu3t/x:gMwNmFz6zaT2CvWxu3/
                                                                                                                                                                                                MD5:655E891768AED2DE72CCE953B228C93F
                                                                                                                                                                                                SHA1:3A702311909B1C16286C549D95109477052F1D9D
                                                                                                                                                                                                SHA-256:E6842B5E345EEA1365144F870A7FC42F937FB323036C8EDEA5E94EC1AE904665
                                                                                                                                                                                                SHA-512:20AB8F20381F6EB90338B5E08BA0F00FA0F82923C3DC1B5F5231F2745B609E9CDD88533DC3604A8152D601B121F1ACFB5E6152EF0AACDDF55338042CA7EEAA6B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/_Kdwoh0a16s.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometExternalLinkedEntityRenderer_entity.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:{mask:!1},name:"CometExternalLinkedEntityRenderer_entity",selections:[{alias:null,args:[{kind:"Literal",name:"site",value:"www"}],kind:"ScalarField",name:"url",storageKey:'url(site:"www")'}],type:"Entity",abstractKey:"__isEntity"};e.exports=a}),null);.__d("CometTextLink.react",["CometLink.react","TetraText.react","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(a,b){var d=a.color,e=a.type;a=babelHelpers.objectWithoutPropertiesLoose(a,["color","type"]);a=babelHelpers["extends"]({},a,{ref:b});return i.jsx(c("TetraText.react"),{color:d,type:e,children:i.jsx(c("CometLink.react"),babelHelpers["extends"]({},a,{color:d}))})}a.displayName=a.name+" [from "+f.id+"]";b=i.forwardRef(a);g["default"]=b}),98);.__d("CometExternalLinkedEntityRenderer",["CometExternalLinkedEntityRenderer_entity.graphql","CometTe

                                                                                                                                                                                                Chrome Cache Entry: 828

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):279627
                                                                                                                                                                                                Entropy (8bit):5.151957894348034
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:c2hPacZGzlBAgyxOmwn135UAcRCHgK0icNaQeUTUdDYubFryHgjKbntICUR:N83tMSC4
                                                                                                                                                                                                MD5:67415238A0ED99286F8261E4A6CDFBE5
                                                                                                                                                                                                SHA1:86EBB0BBD60D8D6BBDC80AA60BC809F17FA9F6D3
                                                                                                                                                                                                SHA-256:7C3190461704D64CB2FB3BBE447902518DCC8A93536E10B7D3475B8ECB836152
                                                                                                                                                                                                SHA-512:01B036685AFA19E0EE5299A6076C76384A18493345E8EF887CBE2B07B3C79B44F1AA3615918807C6BAA876263A5201D4A36195ACCFFA555F6B3F42503EBE6C7A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/642e1qh28prue1yv3o1kqf3z9
                                                                                                                                                                                                Preview:li-icon[type="linkedin-bug"] .background{fill:#000000}li-icon[type="linkedin-bug"][color="brand"] .background{fill:#0077B5}li-icon[type="linkedin-bug"][color="inverse"] .background{fill:#ffffff}li-icon[type="linkedin-bug"][color="premium"] .background{fill:#AF9B62}.artdeco-premium-bug-variant li-icon[type="linkedin-bug"][color="premium"] .background{fill:#EFB920}li-icon[type="linkedin-bug"] .bug-text-color{display:none}li-icon[type="linkedin-bug"][color] .bug-text-color{display:block}li-icon[type="linkedin-bug"][color="inverse"] .bug-text-color{display:none}li-icon[type="linkedin-bug"][size="14dp"]{width:14px;height:14px}li-icon[type="linkedin-bug"][size="21dp"]{width:21px;height:21px}li-icon[type="linkedin-bug"][size="28dp"]{width:28px;height:28px}li-icon[type="linkedin-bug"][size="34dp"]{width:34px;height:34px}li-icon[type="linkedin-bug"][size="40dp"]{width:40px;height:40px}li-icon[type="linkedin-bug"][size="48dp"]{width:48px;height:48px}li-icon[type="linkedin-bug"] svg{width:100%;he

                                                                                                                                                                                                Chrome Cache Entry: 829

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):441
                                                                                                                                                                                                Entropy (8bit):4.728282635502173
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRR9jRxmHRLkCsL9IxflMwhT2fLrYVMdubTci:t4jU/vJHNklhIwwhqgVMEci
                                                                                                                                                                                                MD5:B15A744B5ED7D5D8A779E411F513E24C
                                                                                                                                                                                                SHA1:F156A8D2F03E4FFB072FF7D2241DDCA911664B0E
                                                                                                                                                                                                SHA-256:43B5B8ECC8D128FDD2DF4366CBE6FDD8ED0067DC117438290F59F5A0FFAF715D
                                                                                                                                                                                                SHA-512:3381EC00EEE98892B08E5C47929FFC27129A92ACF486CC33DB7E7DE1128ACBADDCCAA75115A40BC6A91B97CA39FCB42E0661341BF433299720C80DBB3EDBFF20
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/bell/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.32 1.01 1.03 1.01 1.76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87zm-1 .42-2-1.88v-5.47c0-2.47-1.19-4.36-3.13-5.1-1.26-.53-2.64-.5-3.84.03C8.15 6.11 7 7.99 7 10.42v5.47l-2 1.88V18h14v-.23z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 830

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):79
                                                                                                                                                                                                Entropy (8bit):4.71696959175789
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
                                                                                                                                                                                                MD5:8DC258A49B60FAE051E9A7CE11AD05CF
                                                                                                                                                                                                SHA1:DAFEF280663F4205FC7F0E47799E9945E6A68D6D
                                                                                                                                                                                                SHA-256:C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
                                                                                                                                                                                                SHA-512:5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
                                                                                                                                                                                                Preview:.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

                                                                                                                                                                                                Chrome Cache Entry: 831

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1150
                                                                                                                                                                                                Entropy (8bit):1.6001495726289154
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:XFeeeQL5555555555dWr555555555555b5555r555555b555Lr555553r555Lh5k:X2uD
                                                                                                                                                                                                MD5:F2A495D85735B9A0AC65DEB19C129985
                                                                                                                                                                                                SHA1:F2E22853E5DA3E1017D5E1E319EEEFE4F622E8C8
                                                                                                                                                                                                SHA-256:8BB1D0FA43A17436D59DD546F6F74C76DC44735DEF7522C22D8031166DB8911D
                                                                                                                                                                                                SHA-512:6CA6A89DE3FA98CA1EFCF0B19B8A80420E023F38ED00F4496DC0F821CEA23D24FB0992CEE58C6D089F093FDEFCA42B60BB3A0A0B16C97B9862D75B269AE8463B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/img/favicon.ico
                                                                                                                                                                                                Preview:............ .h.......(....... ..... ........................................................................................................................................................................@...@...p.......................@...@...................`...................................................`.......0...........................................................0...P...........................................................`................................PP...................................................................... .............................................................. ......................................................@@.................................P...........................................................`...0...........................................................0.......`...................................................`...................@...@...........................@...@......................................................

                                                                                                                                                                                                Chrome Cache Entry: 832

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (10220)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):78610
                                                                                                                                                                                                Entropy (8bit):5.3865963104482235
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:drOMDK8NFltMD636tzdHaOMjKwSo3XItkuSbFdIy2:drOqFEMjm
                                                                                                                                                                                                MD5:9D42A35D0C80473F09B51A35688175FB
                                                                                                                                                                                                SHA1:4BD6270F438D59FFBD377E6ABEEC3C05B14F0903
                                                                                                                                                                                                SHA-256:4CAB06FAE42AEFB60A7094ECA335FC82BBB160B93351FAEA0602DB68694DB5CA
                                                                                                                                                                                                SHA-512:BDBBDC342928BE7F950D1905FB52987EBB4CD686E3BA4E5BD308C33BD5503FF1EA45AA805A95CDBE89D0037A732017397FDEDF6E288A6049FF0DBDB98FE28CAF
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3idBq4/y5/l/en_US/QR_hERTXCfp.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="26010742205205782"}),null);.__d("GroupsCometAnswerAgentEducationModalQuery$Parameters",["GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation"),metadata:{},name:"GroupsCometAnswerAgentEducationModalQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("coerceRelayImage_image.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:{mask:!1},name:"coerceRelayImage_image",selections:[{alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"scale",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"width",st

                                                                                                                                                                                                Chrome Cache Entry: 833

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):6636
                                                                                                                                                                                                Entropy (8bit):4.762377523885447
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:Gm6G1ItjXwOJvVLATqcQLSIt8xmumUu1ixHRs:j60I1BJvNPcQH8xmumUuixHRs
                                                                                                                                                                                                MD5:B3C466B2D513DB8CCD0F4D7C4648E05B
                                                                                                                                                                                                SHA1:6BC28BFDBA5C7DF8B455A3B88D4C4D9523CCA860
                                                                                                                                                                                                SHA-256:4B4A165585BBA9DA803F7BE0C0F06EA2B97BC1C61B4BF6921AD44E8C6369BF2F
                                                                                                                                                                                                SHA-512:43B6E557980C00C5EBA6D5729E7865DF82707D9611477FB2E3EC271C7EB19ED6870723F68ADDBE254D7867DA5FE89ADD8F10BA2AFD75C2B101140FD3F6F8C891
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/success.mp3:2f70095326601e:0
                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz...............................................n...f...`...k...j...f...h...a...i...e...i...b........stco................udta....meta......."hdlr........mdirappl.............oilst.....nam....data........got_it....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 000002AB 0000000000004915 000000

                                                                                                                                                                                                Chrome Cache Entry: 834

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):740380
                                                                                                                                                                                                Entropy (8bit):5.729920688068108
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:ZA18+tja0OU+uiAlgU/u0rLDmi6Dcga7ciEskOxCoiuNRF:ZTGjvOZArrdciBkpSF
                                                                                                                                                                                                MD5:F98FC311A243467E1323D5CF6E73D4E9
                                                                                                                                                                                                SHA1:C917CCF1F88AA7D74C8CDD4B3A4B5C5270FFA520
                                                                                                                                                                                                SHA-256:86B01C31FAF78C4C275A4CD608DD112C461B7B3553D50129EFED438000D392A8
                                                                                                                                                                                                SHA-512:149022F0DA5D7491E9AE198D3DB033865AE1D0E399A0F0BD98BA3EDE34659461D0042B962D10B4DFD45DD29850C6FE734D6027DE00BE4493B8CAC31B6B401516
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                                                Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                                                Chrome Cache Entry: 835

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                Entropy (8bit):4.734767648393338
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRvxXUjvuoVFMScupjUJEFNJFyOXV/:tI9mc4slhohC/vmVR5XUjvuoVFbpjUJc
                                                                                                                                                                                                MD5:117AB951A6D6204AC74B0A8A2DEBB839
                                                                                                                                                                                                SHA1:0EBD5BAB716E8A101783C60471EA52745CB8459F
                                                                                                                                                                                                SHA-256:988C2499EC07A895EA5B31AB308610995B4F4480142571A47FCD0FFA1A0EFA41
                                                                                                                                                                                                SHA-512:2CC4D015CE64DF7D8390ABF7BD7339B4DFA090E89C37135692C8652E59A46C4BBCD7A451C8B6E45F070A4C3F46935EA51B78F67DAC181B0C38CA1CBC62F000DD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/arrow_up/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="20.21,11.79 12,3.59 3.79,11.79 5.21,13.21 11,7.41 11,20 13,20 13,7.41 18.79,13.21"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 836

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):196
                                                                                                                                                                                                Entropy (8bit):5.091943569663142
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHOoZKbVDCjG1UfJQNK:tI9mc4slhLJ9hC/vmI4pZKeG/i
                                                                                                                                                                                                MD5:93255FE74E40903D5D6D53BDCB39798D
                                                                                                                                                                                                SHA1:3782892EA18A26A0117F1D206964B0CBA9E9E445
                                                                                                                                                                                                SHA-256:C7ED29A9FD41A91422C00A05C48EEE65C48F5CFF70D57D1424F00D1D70A3B85C
                                                                                                                                                                                                SHA-512:BC200854BF7F3570874CD2122B25DBC5DA1816DCF4CD2E2FB2549DB90EB9B279CAFF7F10C854F78D64B4742E1CCB0A3FF0D78D0833E57EE7DF5A80C78B9F66A4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/subscriptions/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M20 7H4V6h16v1zm2 2v12H2V9h20zm-7 6-5-3v6l5-3zm2-12H7v1h10V3z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 837

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (826)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):8035
                                                                                                                                                                                                Entropy (8bit):5.326159900569122
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:scBpCBhS6OycT4w9uTEs/tQ7x09fih6axjOrFBh/ZQxKY8X2UBYRMwtRdB:/fEw9uQsamojEFBh/WxhB
                                                                                                                                                                                                MD5:FDA114F94E54E698B9F2916A3F0046F0
                                                                                                                                                                                                SHA1:5E14300C2D580CEB721201B14C19A858734EB2D7
                                                                                                                                                                                                SHA-256:0833BBD2F41E11AD56CAD5E1E52CCDAFB40F3ABB8D71CB3C8B777455DFFEA95A
                                                                                                                                                                                                SHA-512:008E7B7CD839C1B3BFBBFBEF6A5046BAE979FE95A5400CA45765EB74E94594505BB62C42A4F289B86D2B525919884B8B807A025C6C9E4FF43399829E201913E5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.qLa=_.y("wg1P6b",[_.Dx,_.Gl]);._.k("wg1P6b");.var m0a=function(a,b){b=b||_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},n0a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o0a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n0a(b,a)},p0a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.zg&&!(9<=Number(_.Gg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a||a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n0a(a,b):!c&&_.nh(e,b)?-1*o0a(a,b):!d&&_.nh(f,a)?o0a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Zg(a);c=d.createRange

                                                                                                                                                                                                Chrome Cache Entry: 838

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (45939)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):136364
                                                                                                                                                                                                Entropy (8bit):5.126072695543888
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:YQ5uEi/bA+TnJDpamoObnmodwbwnwmwowd6/yW8RNK+blic1rU6fJGnjkuC6hfMW:rblic1rU6fJGjQ6hkefClYT+Ksc
                                                                                                                                                                                                MD5:CEDCAFD723DC407D51EBF9659ED093E8
                                                                                                                                                                                                SHA1:E466B889B8C527ECE8B428A5AF84737A2FE39433
                                                                                                                                                                                                SHA-256:F2BABCBB7C5F1390299D492DF23A585EBACEE80939034749AFCE66D099B8C2CA
                                                                                                                                                                                                SHA-512:A8188512961D31A926C9889A605F634BC9D1D572F450C302CAF0299741F594F4411F9743B4C5E6A55D17C33E5B67FEC4E0942303656BC6A56CB2B5F81BE89C65
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iQbs4/y1/l/en_US/zx3qoVF3sUZ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometImageFromIXValueRelayWrapper_sprite.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometImageFromIXValueRelayWrapper_sprite",selections:[{alias:null,args:null,kind:"ScalarField",name:"sprited",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_map_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"preloading_spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"w",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"h",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"p",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sz",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",na

                                                                                                                                                                                                Chrome Cache Entry: 839

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):19272
                                                                                                                                                                                                Entropy (8bit):7.961450020257931
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:ATI3kQOJDwl9y7NlAsW6M+hKhZWj5UqW/2cki11kgEQ8bfx3q8lA:ATjl+l9yJlAsbMIKqj5FMT11NE/3g
                                                                                                                                                                                                MD5:E75BCDA2B1FD3E56C1437963E0BCC5EF
                                                                                                                                                                                                SHA1:697B6AAC8DAE65EA318C52C6696B8CFDC2F3D037
                                                                                                                                                                                                SHA-256:47A8F7CCE6124CA58101F3DAE904515A695F03F9142AA5041633CF7323378616
                                                                                                                                                                                                SHA-512:DA7CE8B26F690BBEA85C407F6D470DE9180F079A9F610CCF67DBD67C17313C0E709FA09EDE715E0AC9F9A3685AD53F8861DDE03091E64186BFD13DDF105F5D58
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t51.29350-10/425949254_412895554490351_2676088645844774922_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=EPJ5uebUbVcAX9rPvPO&_nc_ht=scontent-lga3-2.xx&oh=00_AfCJsDc3_Cr_WSbyNtqrkwLJwsw6MHRSZL5ljiimHYbZmA&oe=65D39588
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000b906000086110000da12000047140000082100001a3000002c310000dc3200009e340000484b0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................J2.....d..:...g}.6..-.....|P8...(l....@..A5..~.MO.=.6.k..^.'..L.L.F..m|....;.Y.z.R/.YH.l......Q.yep..'.....t...Fe.....4..>...gX.....FVv.4...*..E...z;_x.S....'..p..b.7-b".0.@..7.C......W....O.L.tSB.A..x......S1...T......:.FU.....-....H....LT..&.3....6_2...A;4FkCo..L.2tT..[Is..H.$..K.1.......V'.h.d.'A........vz.LUs...n.:..C..;.S4a..w?=.\..IQ~....`.Lb(..X.........'j...T.In.>.5*. ....?).......r..*.).I.........l2...&..J.=..|.P.....0..<'yv..5.|......tIU.}.{Z..Z..H.V.A.a.4..<.0s..t...R.;%H..i....*..@e....e%...}....!....y.z9j.e..?...#.c.2..6a...r9.+.k...........5..*~.O.-|3...+....<

                                                                                                                                                                                                Chrome Cache Entry: 840

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (936)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5863
                                                                                                                                                                                                Entropy (8bit):5.542506058381083
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:ercpdAw1xFVObY2GhlzSSt0531195315WnGIjkC4EBBIjKuKSwXr6:ekdAMFVObY2GjDm19D5WnGIj8OByKD6
                                                                                                                                                                                                MD5:F3356B556175318CF67AB48F11F2421B
                                                                                                                                                                                                SHA1:ACE644324F1CE43E3968401ECF7F6C02CE78F8B7
                                                                                                                                                                                                SHA-256:263C24AC72CB26AB60B4B2911DA2B45FEF9B1FE69BBB7DF59191BB4C1E9969CD
                                                                                                                                                                                                SHA-512:A2E5B90B1944A9D8096AE767D73DB0EC5F12691CF1AEBD870AD8E55902CEB81B27A3C099D924C17D3D51F7DBC4C3DD71D1B63EB9D3048E37F71B2F323681B0AD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js
                                                                                                                                                                                                Preview:(function(){'use strict';/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var e=this||self;function f(c,b){c=c.split(".");var a=e;c[0]in a||"undefined"==typeof a.execScript||a.execScript("var "+c[0]);for(var d;c.length&&(d=c.shift());)c.length||void 0===b?a[d]&&a[d]!==Object.prototype[d]?a=a[d]:a=a[d]={}:a[d]=b}.;var g={YEAR_FULL:"y",YEAR_FULL_WITH_ERA:"y G",YEAR_MONTH_ABBR:"MMM y",YEAR_MONTH_FULL:"MMMM y",YEAR_MONTH_SHORT:"MM/y",MONTH_DAY_ABBR:"MMM d",MONTH_DAY_FULL:"MMMM dd",MONTH_DAY_SHORT:"M/d",MONTH_DAY_MEDIUM:"MMMM d",MONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],NARROWMONTHS:"JFMAMJJASOND".split(""),STANDALONENARROWMONTHS:"JFMAMJJASOND".split(""),MONTHS:"January February March April May June July August September October November December

                                                                                                                                                                                                Chrome Cache Entry: 841

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                Entropy (8bit):4.915607757159961
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHC/TFicZHLpsTLXcA1:tI9mc4slhohC/vmI4CbFxIcK
                                                                                                                                                                                                MD5:D4FE0331328D6ADCB2D4B88D0996420C
                                                                                                                                                                                                SHA1:BF668E3964C3BCD702650BB20E28FD303296124F
                                                                                                                                                                                                SHA-256:616130E8A2BE44E0FDCFA1D3C7661172F2FED1471597820F8A3CAF01F4FBE2DF
                                                                                                                                                                                                SHA-512:16DA047FE96F9808AF68EF19E64736114FD3620127964A86973A86401375E128CA99F6C937D1123AE4FD10EEE5079B24BF6C721028582EDEE37176254EE5E3D9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_left/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.96 18.96 8 12l6.96-6.96.71.71L9.41 12l6.25 6.25-.7.71z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 842

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (467)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1883
                                                                                                                                                                                                Entropy (8bit):5.270984374425825
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:o7eM8KL3AiFxglr7iO7S6fg35rCyRWsRhdrw:opL3FxeT7SMJARhBw
                                                                                                                                                                                                MD5:434730EECF5430D42D426FFF04E3751F
                                                                                                                                                                                                SHA1:E6DC1BBDFCCB76D1F45789C0B55E4F9E5725B677
                                                                                                                                                                                                SHA-256:1BFAD0A3BD2AE9BE050D4A66CE800B030E5E33B6048D14FBECF0501A5728E2E9
                                                                                                                                                                                                SHA-512:F68561DF1AF16BE78F48EFA58D836C33246FF8C8ABDE323C9F2217797E027DC99A699ED3856252A0ACEBC601177B78C264F400B56C52B48B500B07BDE76F964E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.gY=function(a){_.I.call(this,a.Ha);this.window=a.Ea.window.get();this.Fc=a.Ea.Fc};_.B(_.gY,_.I);_.gY.Oa=_.I.Oa;_.gY.Ba=function(){return{Ea:{window:_.Oq,Fc:_.uC}}};_.gY.prototype.Cn=function(){};_.gY.prototype.addEncryptionRecoveryMethod=function(){};_.hY=function(a){return(null==a?void 0:a.Yp)||function(){}};_.iY=function(a){return(null==a?void 0:a.rca)||function(){}};_.jY=function(a){return(null==a?void 0:a.Zp)||function(){}};._.izb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.kY=function(a){setTimeout(function(){throw a;},0)};_.gY.prototype.fJ=function(){return!0};_.Lq(_.El,_.gY);._.l();._.k("ziXSP");.var IY=function(a){_.gY.call(this,a.Ha)};_.B(IY,_.gY);IY.Oa=_.gY.Oa;IY.Ba=_.gY.Ba;IY.prototype.Cn=function(a,b,c){var d;i

                                                                                                                                                                                                Chrome Cache Entry: 843

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):17228
                                                                                                                                                                                                Entropy (8bit):7.959913912630626
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:ri6OC4uHqUpfaU84nRkkm/HQHrhhvXiEWX98s+8:lVHXV84RkkK6/TurR
                                                                                                                                                                                                MD5:3EFBF08A743087551DC7B85A00631C45
                                                                                                                                                                                                SHA1:170D4AC0AA59213884DD4229AB175FD8493D7514
                                                                                                                                                                                                SHA-256:478929236C7E6E34D214C8BD9071AB96179E194E44F7DFBEE1864710D70C30CA
                                                                                                                                                                                                SHA-512:B6580D65550CB688120CBA722C33D5D56C3603E72082276B57472AE3B899D6C311BB34732883E06A4319F744A3165D3F0D0D9FFD9F7D08FB239D036EB3C37FC7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426311842_1111590876530316_684127164923359692_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=u49QGUJ1kRgAX8licOq&_nc_ht=scontent-lga3-2.xx&oh=00_AfDcmXpASUA2EPVLROP57O0WHpxnV9weyAR5the_OzedVw&oe=65D46E30
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100000d07000035100000d311000019130000211b00000f28000027290000372b0000e52c00004c430000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..................................................................................Y'.e...O..9..;f.Yy..!.'.}I....F.s.k...Q3.9Mg.. .k....3..|.V6...D`.^..*..S..2.z.DnLw...c}0e....%.$..B2)RH.)^O.8...0...zM.\..W.]i....{.........xK.K_...lr..v.fr...'+/..j.*Y.~....i...gZb....z.t....A(.hh...4.;.a.AV........q..0VJ.5.-j..U.3.?5..9.V..k.NU.....x..M.Sac..Tv.v.a..q/...cl.j..~Oa,.C...7.v..S.Q4.......mui.[.2.8d.G$"..Z\mv.{?n.....h.N.U.u..........=..jWz,.vG.:.Tiv.0...e.]...gz....x..u........P..-..k.m=N`UKs2.6...:..T......=.r...n..5.fj..h..9p.6.JV9...G...yo.4:.Fg.1..3.7..x.*.X..L.6.Y.O..G..Z...)EOG.t.^t.n.R...c...{......._!.>r....<....w..8y9 . .:<.f..ZR.......gw..T..2.K

                                                                                                                                                                                                Chrome Cache Entry: 844

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):364
                                                                                                                                                                                                Entropy (8bit):4.5307728192386865
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4wFs0BIiV2DTFVRrZjih9gCqzOfHLVlZ7YoPV3aXtJlIXtz3:t4noU/vmRwFs0BIXDJHNjihnbH7Z7YOn
                                                                                                                                                                                                MD5:9EDB56221B5B65134491A96453F9407C
                                                                                                                                                                                                SHA1:323001B08DF5DF6962781334D9BDDDBDCFC9E0AA
                                                                                                                                                                                                SHA-256:5E020ADF6151A4814846CB07EC91E9902C8860F1445F5F9321C5FDD81A06F102
                                                                                                                                                                                                SHA-512:373A6F0D45A1B955DF57858CCCAB05503FA31962BA47D5FDE6F5039D8E7E7FF72EF7B2FF4BA261E80C7DA630016BE142C4E319FE7CE66B0FCE9C317E77016053
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/location_point/v5/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c3.31 0 6 2.69 6 6 0 3.83-4.25 9.36-6 11.47C9.82 17.86 6 12.54 6 9c0-3.31 2.69-6 6-6m0-1C8.13 2 5 5.13 5 9c0 5.25 7 13 7 13s7-7.75 7-13c0-3.87-3.13-7-7-7zm0 5c1.1 0 2 .9 2 2s-.9 2-2 2-2-.9-2-2 .9-2 2-2m0-1c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 845

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):48
                                                                                                                                                                                                Entropy (8bit):4.157806386887449
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:ZjhnZNDrPKVXdl:ZjNjKVXdl
                                                                                                                                                                                                MD5:0D9FE9D3AA33DA6C96F6BF9AF269F8B5
                                                                                                                                                                                                SHA1:A089B5586CD5E479A0FD7D73591C7EC0C5A41235
                                                                                                                                                                                                SHA-256:1C9E270C0A66096127A7F58A326D4728465B433D744B3066F3F28CD5E87C9576
                                                                                                                                                                                                SHA-512:3A15B10B23D0259F2738B01517E734C41122D68EFA555BE2CC1E162028FB4C7E88617D783BA571D82554B9CE3DDAAAD046A4BEBAFA1A87D79CEBD5A7EDD17571
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwnAFtBk7-_xrBIFDQqzETASBQ0o8SlJ?alt=proto
                                                                                                                                                                                                Preview:CiIKEw0KsxEwGgQICRgBGgQIVhgCIAEKCw0o8SlJGgQISxgC

                                                                                                                                                                                                Chrome Cache Entry: 846

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):15442
                                                                                                                                                                                                Entropy (8bit):7.9592303487053275
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:0gzQyrfPOAwzlkrqF0DClAi1zyz553uqMH6Yp:fEyLmnkrG0OlAsyzzeJXp
                                                                                                                                                                                                MD5:30AC571E9B6637C35E397B45B8F800FE
                                                                                                                                                                                                SHA1:14540588B7B1D9C3ABD7F3A38E4EE0F49F75E4F0
                                                                                                                                                                                                SHA-256:222E3C5F8E6CCDE7BA7F1E6F71D313F34833AD7769570BB31F1C484951B9B69C
                                                                                                                                                                                                SHA-512:7AA363351EEB8EA774738EE53473F3BC2F3D4E7BDC22D52143E783E63252D76BF2F23D6449257F3C1E2D035F4418F7E10A23A797C17FEC83CE8B284B0EAEF01E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426270331_412589158002834_7443474100637817948_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=KpH9NUh33F0AX8hsa-9&_nc_ht=scontent-lga3-2.xx&oh=00_AfCIjecUEr-Rt-YSbHt_4lYC9tGzZJHcPJCaiKAESvtLmg&oe=65D30136
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000a20600001c0f00004e10000078110000c61900008e2500009f2600001328000089290000523c0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n....".................................................................................U......F.,.....r..c,...M..-...Z.!.y.>.W<...{3 ....]evc.}..AR..>.y...MfP.>HU...h.bK.T.B.\.`DR...d.....A..;....}."E.ZU...Th}i.SCXgZh\...B.;.XH.. b'.p..}..1.w...t...e...9.Y....71..h.Lq.*n.-...e.}..s...NS.|..(....c...I.."..b6p.X}...$.3...<.^..x....|.w.g.1.....z2..*]6{_6..S(N......p...........|..........;l..yj48.-r....RjO..4..g4R..r./.#.?......h..@[..Lc..Jk.......Y..J:...|:..[O..*..C!....._G6...S..t.....I.[....e..j......*m..DA.n6_:...K..1..~{..[Q`..m.H]N..3.(.....L...A.Dd..-O....&....>A.....?C...o...2_.@.#....je.OR...Mu...y.R0.f'L9E".....6...z.".~......)^..L.o.Pde...c.U...........

                                                                                                                                                                                                Chrome Cache Entry: 847

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3795
                                                                                                                                                                                                Entropy (8bit):7.186426797821181
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:g11W5IUnzN8Ab0uYzzl29Z7J53YHnN6vJyJ3+xL4qogy:U1WOnAbq3yd5oIw39gy
                                                                                                                                                                                                MD5:2B70B346B33877CF73A0D1FDA1DC0B63
                                                                                                                                                                                                SHA1:AC90102A5BC5D0259ECA0A57691BFAF82D9DF7D8
                                                                                                                                                                                                SHA-256:E54BED88785584EB1B517D77A3965C563E2EAF408CCC18D0DC70A3C23C9DE56C
                                                                                                                                                                                                SHA-512:16CDAA91FB64BAA1E7EE50F2B61C4BEEAFAA962CBF80744E606607DA2939FD130DF884D198F86250E13504329CC215780011D7B3FBC2F9D35B441ABCD9984D5C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i4.ytimg.com/vi/mzRMv8sifG4/0.jpg
                                                                                                                                                                                                Preview:......JFIF....................................%....:'10.'-+6<PB4DU9-,EaEKSV[\[2MempXlPY[W.......%..-W6-6WWWW]WWWWWWWWWWWWWWWW]^dWWWdWWWWW\dWWWWWWWWWWWWWWW......h....".......................................:......................S.......!1AQ..Rq.."BTab......23r.#..............................$.......................R.Q.!1A"2..............?.............................................................................................nv.FJo.o.m....\..3..4.i..lT....m....\.L.l.....S....*rS}su3..=.Q...9i....b.-7.7S0mS....S....z...u3..=.A...9i.&.mz....u3..=.A...9iy&.mz....u3..=.A...9iy&.mj....u2mS...S...n...K.7S&.=.1...9iy&.mj....u2mS...S...n...K.7U.Ohh..j....jr..M..Ohh..j....jr..M.2mS..1..9iy&.R.-/$.W&.=....U...n...K.7P..4C{.*...M..Yiy&..T...ov.VZ^I....I.7Q6.....m:....u6.VZNI...=....U...n...I.7P..4#}....rM..UYi9&..t...o..VZNI..J.-'$.Cn.......I.7Sh.e..m......5Yi9&.m.....u..;C@7.B.-'$.M.U...n..Ghh...hUe........u..;C.....I.7ShU..m.....6}^jNI..>.5'$.Cn....A

                                                                                                                                                                                                Chrome Cache Entry: 848

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):4119
                                                                                                                                                                                                Entropy (8bit):5.363860210804462
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:GkBsIzf6Aj6TQTdkvEc2K7UrtNoyd+ypYokBnz8oLw:3BHzn+Wm97UToyd+ypYokDc
                                                                                                                                                                                                MD5:B60A1BABBA7EDBA6C5A9FC4836A079C6
                                                                                                                                                                                                SHA1:082278E6B6E8A2F53237EE992E77FE45F8764957
                                                                                                                                                                                                SHA-256:A925BAF5E1E6227CE778335AE876AD0B2C0A46AF791E2FE0BE7D9548015BBD82
                                                                                                                                                                                                SHA-512:975738EE48432A77B3423E4BE71EE3FAEF65CF03EFA95A786357438132ECE6942ACF1163DB3A1513515A8617807D5C21DA44CB510E32DCA941927F5C369388B9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                                                Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.uf(_.hna);._.k("sOXFj");.var Rq=function(a){_.I.call(this,a.Ha)};_.B(Rq,_.I);Rq.Oa=_.I.Oa;Rq.Ba=_.I.Ba;Rq.prototype.aa=function(a){return a()};_.Lq(_.gna,Rq);._.l();._.k("oGtAuc");._.Gsa=new _.qk(_.hna);._.l();._.k("q0xTif");.var Cta=function(a){var b=function(d){_.bm(d)&&(_.bm(d).uc=null,_.er(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},qr=function(a){_.np.call(this,a.Ha);this.Ra=this.dom=null;if(this.Zh()){var b=_.sk(this.Cf(),[_.Uk,_.Tk]);b=_.wh([b[_.Uk],b[_.Tk]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.Dq(this,b)}this.Ma=a.nh.U7};_.B(qr,_.np);qr.Ba=function(){return{nh:{U7:function(){return _.ff(this)}}}};qr.prototype.getContext=function(a){return this.Ma.getContext(a)};.qr.prototype.getData=function(a){return this.Ma.getData(a)};qr.protot

                                                                                                                                                                                                Chrome Cache Entry: 849

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.youtube.com/pcs/activeview?xai=AKAOjss1nrwdau8LRCtEZgbAhgA_4zJWepeDfm0miPvEwrpuqyVkXbGx3IxNi9o6nmmNllI9RZot_bz6SvERtymrKQOWt-pJBqzETB4FVbyE2ll_gaxlVMJAaL4XZEf7mEwGBxNOcbBGwQedIA&sig=Cg0ArKJSzOR0CJ99uqQgEAE&ad_cpn=[AD_CPN]&acvw=id%3Dlidar2%26mcvt%3D1013%26p%3D136,96,484.484375,466.65625%26mtos%3D1013,1013,1013,1013,1013%26tos%3D1013,0,0,0,0%26v%3D20240214%26bin%3D17%26avms%3Dnio%26bs%3D1264,1024%26mc%3D1%26rs%3D17%26la%3D0%26vs%3D4%26r%3Dv%26pv%3D1%26pbe%3D0%26vae%3D0%26spb%3D0%26io2%3D0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0%3D"
                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                Chrome Cache Entry: 850

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (555)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2504712
                                                                                                                                                                                                Entropy (8bit):5.663845300759951
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:ZEM4kdsJepUkt5ACmgRwDOZoxuwGzGtTFiW6UoveH2M8:z4kO00gRwDOZoxuwJFihveWM8
                                                                                                                                                                                                MD5:E0ADEB81A95B5CE2D852B1DA7CEA4528
                                                                                                                                                                                                SHA1:B56E9345A734C0C35FBD05AB042686698544B3AF
                                                                                                                                                                                                SHA-256:88D25B8C03E76364C6C7BBDD74F9686429648EE83A9367EE8347F8ED9E5ACB11
                                                                                                                                                                                                SHA-512:B66A26F328D403BA196253E82F738DAE597E6CEF8727E5DF01520DE54C3D53FDF196F1F2B169F1912E386B2D86D5E3BF43AC66DAF8778475E0B60ACBF418E0EE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/base.js
                                                                                                                                                                                                Preview:var _yt_player={};(function(g){var window=this;/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. (The MIT License).. Copyright (C) 2014 by Vitaly Puzrin.. Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONIN

                                                                                                                                                                                                Chrome Cache Entry: 851

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1675
                                                                                                                                                                                                Entropy (8bit):7.085744606593646
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gqYA6sc1spiW9duRzuryx2vMDl6ZTCwY0timvvC+Nnhlq7FVtojgnTAQTOj6T:grsiWiW/uhuavQHntimnC+p+/2js/CuT
                                                                                                                                                                                                MD5:DF6A328518EBFBA63EDE97AA4438B952
                                                                                                                                                                                                SHA1:E6C282079504C552247195F859861749B121F67F
                                                                                                                                                                                                SHA-256:603C765B82BC6F97A88BE954BE678FD314BFD159FD06D84E0623D2907800DAAE
                                                                                                                                                                                                SHA-512:098CCA769950AACFB108AFA5B67A859C57D95E8FD65B4309EB9B38F7EC78D9B15C11F65D389AC85883F2FFE17D79D82D1C2A46DB0AB68FFA690923A9CE24EC74
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/420128093_395113823189898_8636524149536146420_n.jpg?stp=c0.31.50.50a_cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=PHZnI2WdFqoAX-8fvZ3&_nc_ht=scontent-lga3-2.xx&oh=00_AfAnrwDEkMoq8ck1gE5OCJBXuM6OiYONR2Xud92dySY8YQ&oe=65D2AEFA
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e60100008b020000ca02000010030000d30300008f040000c9040000110500005b0500008b060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................\{...........dH..}.E.l....9...90V...Z.dlt....t7Z.F...vA6..Q.....%.............................!"312A..........s.....fH'.l.f...J..Wb..U.>.Vs...&.L.Y$.[(g......._N..;G.Lf.v..V.9....y.=.#...+.MP..&.5.>f0...U!B.q.l.)......o....!.......................!1.. AQR........?.k;..%RU.a..Ev...`Lo............................. !Q........?.u.5...F&...Q.F.....)........................!..1AQ"a.234qr.........?...A.,.[..Xk.u.DW`..}.....J...z.,.[R.|O.~;O.bc!.@..[. ..B...jk.l.....iM.E.c0.OHB...7....]...q.aS...N3i....|.T..)..b...5.s/...TF..!..X..p.....0...."....................1!AQ.aq.............?!.C.%...Yc..

                                                                                                                                                                                                Chrome Cache Entry: 852

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):552
                                                                                                                                                                                                Entropy (8bit):4.4354471280851335
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4tM65JA+KtIeDBmtMsZkvRP8x0iup0LELeyw5c+QU:t4tMMJALH8MsqJUtDoie+QU
                                                                                                                                                                                                MD5:A57A74B00971D94B2CCA706685A9FBF6
                                                                                                                                                                                                SHA1:8F24E8FAB4F92F58C23D451C3C8C6966C3A7B3E2
                                                                                                                                                                                                SHA-256:2C13665427EA079DB0437534FD5C3F43E144D4707F129267C56F0352FF582EC0
                                                                                                                                                                                                SHA-512:0A64ACB3697FBF5EC6A6D8DC46587E1A2A044F43D8DE0168F733B6276101F4A623D494E250D0C60A9E76C556ED288014530401A7C42F00F6CF5CBBE4AAD30748
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-share/v2/32px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M17.7375 5.26556L28.6745 15.2624C29.1083 15.6589 29.1083 16.3422 28.6745 16.7387L17.7375 26.7356C17.0958 27.3222 16.0628 26.8669 16.0628 25.9975V21.6217C16.0628 21.6217 16.0627 21.6217 16.0626 21.6217C9.92564 21.6217 6.69114 23.9378 5.1615 25.5968C4.80726 25.981 3.97329 25.7343 4.00015 25.2125C4.22558 20.8321 5.86088 10.8892 16.0626 10.8892C16.0627 10.8892 16.0628 10.8892 16.0628 10.8892V6.00368C16.0628 5.13426 17.0958 4.67898 17.7375 5.26556Z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 853

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1755
                                                                                                                                                                                                Entropy (8bit):7.142907895030303
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:g6t3riWkTEtGMY917N9gpxpfXZ7Z2gQ3AR8iG:htS647N9gpd7lQwRpG
                                                                                                                                                                                                MD5:E2F908AF831BD754CF23F7931A8EDBF4
                                                                                                                                                                                                SHA1:37DB2DBDB4D594115D34790701EBA825220B792E
                                                                                                                                                                                                SHA-256:3F106EED13E01E9170D93A97AA98749E1E6838F8910CFFC85057741E2D50BCB0
                                                                                                                                                                                                SHA-512:332C3E72DED4EE40F44C6764E042D3F4285EB47B242AC435AD1AB786C3BCEABBA710F7E5644C1453873DB53D7E5367837013B1CD05B87200D74D90AB50C73E46
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/358397714_152694147828634_7993565465993379038_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=aQv7MBLR-l8AX--R6bb&_nc_ht=scontent-lga3-2.xx&oh=00_AfBbCkFiQID2srB5JnUxsJxRkIaNtVNqfmQu08P2vZovjw&oe=65D305B4
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000f00100008d020000ef0200005803000010040000c00400000005000062050000bf050000db060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................Y.[..N.D..u..3.!L.4..........K]..B\.-...<....f1.g]......t..*.....Or./3...$..........................#..!2"45...........Es8..4.X..0.[F.{.j./<.}..1'...[.e..e.....T.6..r7.>,T ..o.A.jK.G.....g.6a.$....%..N_.8j.=.V#..._..3.'..z .....".........................1..."2C........?.E.x.F...s&....b&..z.........f.J".....L.V...i^.}......"..........................1..!AC........?.v.9...g.1n..2..J.i..I.....).F..X...3..~3..A........)........................!1A"Q. 2Bqr#...........?...xND......#.r.e.X.l-,..$.*. ..#7..e.i....3R..v."..U...-%6..S:..n..-Jc....f.=z...h.....*.o.7.P..7..`.....ejK...*S..}....4]e....`..

                                                                                                                                                                                                Chrome Cache Entry: 854

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):231
                                                                                                                                                                                                Entropy (8bit):5.077824311544019
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4G93gkIk6wy7Ndc8:t47N9U/vmRk3gBnV
                                                                                                                                                                                                MD5:455D4C6D10C83A1C3F62725C71F25BB9
                                                                                                                                                                                                SHA1:61F339D3E56879E1B4680D7229BF8B88BE9CBC8D
                                                                                                                                                                                                SHA-256:7834ADC55F57ED2863E9F0BF3D4944458EDD13D85F3207F7FE8BA2B2BFFBA464
                                                                                                                                                                                                SHA-512:C0C7A0378A799AB3D867B4FD63D6133564E1BB35C797D59DA621B235A73C18D4B90E308731CD09A1731175212D75CF9CDA31DF539230048BA60108A1069E8673
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/flag/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m13.18 4 .24 1.2.16.8H19v7h-5.18l-.24-1.2-.16-.8H6V4h7.18M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L14 3z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 855

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):6529
                                                                                                                                                                                                Entropy (8bit):4.679709782974826
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:xm6jey1gwRj0yKmn1Z2rUKO5YhhzFEyDeg5n:M6CIgwJ0xm1wS5Yvzt
                                                                                                                                                                                                MD5:BFC8E752C754A9B52D6BD4A963A7B9C3
                                                                                                                                                                                                SHA1:7DDEF10D9AD3F43C89164B7DEBBC9CE26512B036
                                                                                                                                                                                                SHA-256:704A5E15AE1068E4DF52A8BCFF04270EFDAD595CF685E0ECCFF86AB335471A46
                                                                                                                                                                                                SHA-512:FF6415C30F7839666CE0BDB20FEA71D19630EA75904A4AAD710DC6431604532FBA48CFDA4B326BEAA6502ED727A0A9208DD624A4AC37B7601526BD611D7364BA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/failure.mp3:2f700953253540:0
                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz.......................~.......k...................a...c...[...Z...c...`...d..._...^...\...e..."....stco................udta....meta......."hdlr........mdirappl.............nilst.....nam....data........error....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000063 0000000000004B5D 0000000

                                                                                                                                                                                                Chrome Cache Entry: 856

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):151
                                                                                                                                                                                                Entropy (8bit):5.020176826819927
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHqJtxTcR+NkzlFWttxci:tI9mc4slhohC/vmI4ItxTcM6D0Ci
                                                                                                                                                                                                MD5:ABCB07D23B020A9464DD70FA10C0D9D3
                                                                                                                                                                                                SHA1:38EC787E83181D5907C71676C2C4A21EF4D5B72D
                                                                                                                                                                                                SHA-256:D721B8669114FBCDA49F612047DC68869FD406A82AC9BAA420ECF35FFEB05C2E
                                                                                                                                                                                                SHA-512:5218BB6A31E50DA5F42ADD673562C03B970C77FC85E9037ECB85ED9B005015EB754017B27351F04DA7622FBE2EED0CC4CCCF82CF73F6EFAD6C1665789AFD9E51
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/copy/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19 6v15H8V6h11m-4-4H4v16h1V3h10V2zm5 3H7v17h13V5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 857

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):165
                                                                                                                                                                                                Entropy (8bit):4.914928959846639
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcH0wvl7MJJTTtX+nIVrtXypS0:tI9mc4slhohC/vmI4PSTTl+n8le7
                                                                                                                                                                                                MD5:A64DE7E4B8E12D0201357414E2ED618D
                                                                                                                                                                                                SHA1:2DEE7B56217F540787CA82D03AB6171D08E23BE1
                                                                                                                                                                                                SHA-256:BA0D0E7E11AC72A801626946BE1B061DD59D990DD33077A37A08149917A7E930
                                                                                                                                                                                                SHA-512:A947F3619B2150621376D0CAC479AB6F522CAE7E651A917565050A4BC5ABCE6E60B3652DAC4D1CF90C0255FA09FC8EAA9B31EB6EF6A23D2E31AB497C86AAACB4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/list_play_arrow/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M15 19v-8l7 4-7 4Zm7-12H2v2h20V7Zm-9 6H2v-2h11v2Zm0 4H2v-2h11v2Z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 858

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5430
                                                                                                                                                                                                Entropy (8bit):3.6534652184263736
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
                                                                                                                                                                                                MD5:F3418A443E7D841097C714D69EC4BCB8
                                                                                                                                                                                                SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                                                                                                                                                                                                SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                                                                                                                                                                                                SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.google.com/favicon.ico
                                                                                                                                                                                                Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

                                                                                                                                                                                                Chrome Cache Entry: 859

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (6544)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):30894
                                                                                                                                                                                                Entropy (8bit):5.582255413109731
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:d/HMmkEeGSQnBx355zXv2Vpfd2A2Yjdwl5hdvWewVebB:dHVnPBh55zf2l2YL4
                                                                                                                                                                                                MD5:3E16032BA5D512741B2F07449A0100D3
                                                                                                                                                                                                SHA1:E3A0EA1BA4A3BB8D0B28B6D178E517C84BC8883D
                                                                                                                                                                                                SHA-256:2F6FE28E4D7123C73C31D387630E75B3AA729977EB0FD2CA7224ECFBB9314C45
                                                                                                                                                                                                SHA-512:EB2BE26E74EB1B49EF15FCFD5F6C038B869D70FC1A24C3149AA3FFD624FBEFA00338AADB8C77214CA3383A877A78BE493403245FBBFB61831B364671E7E450D1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3i0Wo4/yy/l/en_US/Ojt4ymYd9n3.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometContextualLayer.react",["BaseContextualLayer.react","react","useCometVisualChangeTracker","useMergeRefs"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(a,b){var d=c("useCometVisualChangeTracker")();b=c("useMergeRefs")(b,d);return i.jsx(c("BaseContextualLayer.react"),babelHelpers["extends"]({},a,{ref:b}))}a.displayName=a.name+" [from "+f.id+"]";b=i.forwardRef(a);g["default"]=b}),98);.__d("CometTypeaheadProgressGlimmer.react",["CometProgressRingIndeterminate.react","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(){return i.jsx("div",{className:"x6s0dn4 x78zum5 x1iyjqo2 xdd8jsf xl56j7k",children:i.jsx(c("CometProgressRingIndeterminate.react"),{color:"disabled",size:24})})}a.displayName=a.name+" [from "+f.id+"]";g["default"]=a}),98);.__d("CometInternalTypeaheadFetchContext",["emptyFunction","react"],(function(a,b,c,d,e,f,g){"use strict";var h;a=h||d("react");b=a.createContext({fetch:c("emptyFunction"),isL

                                                                                                                                                                                                Chrome Cache Entry: 860

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):95538
                                                                                                                                                                                                Entropy (8bit):5.436334510106879
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:8Aa0TZtPgFqdho7ia+2O9UMyc9nh7Hq2E:LTZtYFwF95ycFJKX
                                                                                                                                                                                                MD5:727CBFA3B7290D35E267891F582F88B1
                                                                                                                                                                                                SHA1:AA9B4CE6826B46DB56E8FCAE0D1284248BF6C278
                                                                                                                                                                                                SHA-256:A5951034FFBA6569EF62BEFC21854C90CD987F3935BF1826E5455ED47EECB5E2
                                                                                                                                                                                                SHA-512:271A8A1D392C81490D01079F8C9C9856ED3E73CC552895B9C290E19CB06E953D247FE410A5641B95801109E4DDC65C98F8335E8236E83195B4BF0BE0E61808C4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/6s06vlv92ffjugj7k5xnkp5m9
                                                                                                                                                                                                Preview:!function(t){var e={};function n(r){if(e[r])return e[r].exports;var o=e[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var o in t)n.d(r,o,function(e){return t[e]}.bind(null,o));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="",n(n.s=114)}({0:function(t,e,n){"use strict";n.d(e,"j",(function(){return u})),n.d(e,"x",(function()

                                                                                                                                                                                                Chrome Cache Entry: 861

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (709)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3940
                                                                                                                                                                                                Entropy (8bit):5.104105488091595
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:KOR0kZK2BOR0kFrVkzzQxPYqX9q2lqAEY8HIXOYlSMLycA1:FVmRqb7N7sq
                                                                                                                                                                                                MD5:6916DB7596B63F9CB193EE9834E1784A
                                                                                                                                                                                                SHA1:F505E30CE1FA5BFF6071DE0FCC01705CEA0EB2F9
                                                                                                                                                                                                SHA-256:7984F27F1D4F769196A636207EEA30ADDBAE2DD70C1746EFFF828213A8B88D24
                                                                                                                                                                                                SHA-512:B92242D4CA9ED988EACC40D8B2241E5D78313B545AE9FE3E2972418349258FC03C122DFB00E1BB1B68ECE3E528F26BF75A85B15BD4649250F2D10E57FF1A08E6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/nr2sjxD4QmH.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometVideoHomeCatalogRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7332904830081595"}),null);.__d("CometVideoHomeCatalogRootQuery$Parameters",["CometVideoHomeCatalogRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeCatalogRootQuery_facebookRelayOperation"),metadata:{},name:"CometVideoHomeCatalogRootQuery",operationKind:"query",text:null,providedVariables:{__relay_internal__pv__StoriesRingrelayprovider:b("StoriesRing.relayprovider")}}};e.exports=a}),null);.__d("CometVideoHomeLiveRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="8274177899276614"}),null);.__d("CometVideoHomeLiveRootQuery$Parameters",["CometVideoHomeLiveRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeLiveRootQuery_facebookRelay

                                                                                                                                                                                                Chrome Cache Entry: 862

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):484
                                                                                                                                                                                                Entropy (8bit):4.378279176071406
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noU/vmRhChc2LX7pC52k+N4ezW0qw9DIRSY:t4oU/vYqVG2kCCw2Rz
                                                                                                                                                                                                MD5:2739BB8635C4631E78B240C8B83D102A
                                                                                                                                                                                                SHA1:38B8FDB6A8444513D18378E789547B377CA46DDB
                                                                                                                                                                                                SHA-256:FDE8C85A62FB4E29C3CD902167B791D0D06C3AEEF85C8DDDF3212287FB771A0B
                                                                                                                                                                                                SHA-512:A2A5F5AF163E487943608C9646A6F30BF870607FC7753C14621BC9592483713D9E2F4B40A63030AC820F56E310D3116E78E3E959AD869E9F77FFE9EC6C133CD8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/gear/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19.56 12c0-.39-.03-.77-.09-1.14l2.19-2.13-2-3.46-2.92.83c-.6-.48-1.27-.87-2-1.14L14 2h-4l-.74 2.96c-.73.27-1.4.66-2 1.14l-2.92-.83-2 3.46 2.19 2.13c-.06.37-.09.75-.09 1.14s.03.77.09 1.14l-2.19 2.13 2 3.46 2.92-.83c.6.48 1.27.87 2 1.14L10 22h4l.74-2.96c.73-.27 1.4-.66 2-1.14l2.92.83 2-3.46-2.19-2.13c.06-.37.09-.75.09-1.14zM12 16c-2.21 0-4-1.79-4-4s1.79-4 4-4 4 1.79 4 4-1.79 4-4 4z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 863

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):114292
                                                                                                                                                                                                Entropy (8bit):5.5528653263166285
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:BfaN1hvawAB3MAYcKh+CY0YcQ1rFPyY5c/F1FRLf+aD3Wp94yXCQC4NIT3PTtSGa:BfaNbAB3IacQLiPFRLf+e3g9bXcAITk
                                                                                                                                                                                                MD5:EA5144AB403234BE650A76530D1CB29D
                                                                                                                                                                                                SHA1:67DEE97C0AE2F912CE9F4CB1ADB9181857A01DF3
                                                                                                                                                                                                SHA-256:6EA25790432AA3DF786FF6518EAE8400D61081EE2A2206082C24B3FC6D4705DF
                                                                                                                                                                                                SHA-512:74998F4A928418639BCC2C4EE5BE2DABDC01D5D4C5E3C69BA606E9A0757D173EC542BBD3BD2CFC31CBC17057B421773778997A80F1C4925022DEE0A0B4CA0241
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Atb=_.y("ltDFwf");var AU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.$r(this).fc(function(){this.Fa.length&&(this.Fa.forEach(this.f9,this),this.Fa=[]);this.La&&(this.La=!1,_.Bq(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.Bq(this.mb,"transform","scaleX("+this.ja+")"));_.$q(b,"B6Vhqe",this.Ca);_.$q(b,"D6TUi",this.ta);_.$q(b,"juhVM",this.Ma);_.$q(b,"qdulke",this.aa)}).build();this.ea();_.zg&&_.$r(this).fc(function(){b.ob("ieri7c")}).Ae().build()();_.ez(this.oa().el(),this.Sa.bind(this))};_.B(AU,_.J);AU.Ba=_.J.Ba;.AU.prototype.Sa=function(a,b){Btb(

                                                                                                                                                                                                Chrome Cache Entry: 864

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):511
                                                                                                                                                                                                Entropy (8bit):4.622942488641842
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:trwdU/gKup+tiHD6x2wiHDXx2wiHDi25iHDV25iHDc:tYU/duItq68wqMwqt5qw5qc
                                                                                                                                                                                                MD5:A229E3CF403001E92CB1EA441D880E54
                                                                                                                                                                                                SHA1:1C4518AA326967D4BC424FD14C65D1A3276B5100
                                                                                                                                                                                                SHA-256:952AC1A0AE07753F75FA27BBE483E71C43B29DF5C160AAE33BB447C0E5B5E751
                                                                                                                                                                                                SHA-512:6B30EE9BECA55C6FC5A92330CEB5AAA3F70E1B1A166A6CE7FF0059F619F525673B8160D2A6D35E6D6B35CB52FDB547F3EEB8F960B2E7356C4C2C699115FEBA66
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/waveform/v1/24px.svg
                                                                                                                                                                                                Preview:<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">.<rect x="11" y="2" width="2" height="20" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="15" y="6" width="2" height="12" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="7" y="6" width="2" height="12" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="3" y="10" width="2" height="4" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="19" y="10" width="2" height="4" rx="1" fill="white" fill-opacity="0.3"/>.</svg>.

                                                                                                                                                                                                Chrome Cache Entry: 865

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1761
                                                                                                                                                                                                Entropy (8bit):7.078564306237651
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gqktc1spkHJRSAiTQDPWEQb/W1e4Doxt+R28JDqzNjOGNiL/YL43zBG4frCE3BR:gdiW9AiMjWELwO2+2mq5NNE/YLKzTxRR
                                                                                                                                                                                                MD5:08597AED28A972E00CAAC062093B14C2
                                                                                                                                                                                                SHA1:947CE6CF0F13FB6F0B7D8835CC2DE3E5403A17DD
                                                                                                                                                                                                SHA-256:20A7B542EB3D49ADD51EF24F16E8DAA681B64D03DDF46D6C194CC5F469C7A86B
                                                                                                                                                                                                SHA-512:5E6906614BEBA7FDF3B804A37D9143456858F81BC46F4FA588154E707C993540ECBE37A8C1DE662AC2DD193C1CED0F2F6F4D7D8D70D644CC228F6C74F3C75F2C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/348683614_6159579877493412_7564255008809836111_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=Vs5Mtb0uqiMAX8o6eHu&_nc_ht=scontent-lga3-2.xx&oh=00_AfCIBAYDrrjo9RcJq9cFrrUkEYbBol7WePhy0Yx0WDcIyg&oe=65D2FA37
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e00100007c020000c70200001b030000e6030000c4040000fd040000410500008d050000e1060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................E<....__...]..h`S%J......5j..fi&..j...T...<...C..m..}@X.t.q..... ...........................1"2...........5.~B.%.bIp......^.ot.j..v.J"Z..W.0\8#1....S./d4eJ...x.F kX...K.9.{1.`[(.......@S..,.'#-8..Z.E.>..g#.9......... ........................!1A."Q........?...:8-..~LHO.t...Ib.ei.^...?...#......................A....! "12Q........?..2.&.W...O..ZX...2....8.e.=....+......................!.1..AQ"3q. #2Bar..........?..Je0.5.Wd.o\. [._\~.6..2{'s.-.2X...T..-..Yxo~.?..eN.0.T...Jb..p...=....=.X5[...3..N$......V...e09.....a.!..s..y..2.~Y..X....el....n..Y...l...l?..Y.?....#....................!1QAaq.........

                                                                                                                                                                                                Chrome Cache Entry: 866

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):17674
                                                                                                                                                                                                Entropy (8bit):7.990153353582752
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:384:KMgIWysImk/JvD3DKa12xSaQkSglm8NvAEl3VE4V+tgUpKdIdeN:nBWS//J7zuIaQkSkZIENy9rKdIoN
                                                                                                                                                                                                MD5:07E12F60EBE513D12A1B77B7D92EC5A6
                                                                                                                                                                                                SHA1:95E387D9F7ED520AE914634BE2ECD48009BDEB62
                                                                                                                                                                                                SHA-256:6EB2467F460C4771C57250266AF950DEC37E1BD9DE12A401E96E330294116112
                                                                                                                                                                                                SHA-512:9992FB4824877B48F88AE8D7B0F48B96A942E089B3F0D7C72E52DB8B0B106243B4A89872AC76B1DE2601F470810C89FA2696E1282252C8E38520B65D88511957
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/cdmKVXynX3I/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDdaK7yKjWdD35DnbT5o9eiy7DWyQ
                                                                                                                                                                                                Preview:RIFF.E..WEBPVP8 .D...4...*....>Q$.E#.(".R.....gnB...H......;.Lx...[..E..........>._.v.....v......z..+.7.~...!`.].....'`.^;W+........Oa..n..Q)...^.B..}....C.Bi5T.`.?.W......wb..=...A....ja.dO.K'.#<.f,5.#.6.Gv ....lA.....1a-.(q..g5S....4jCO..|G9_..........5YG@...M...l.8..,0...........7.......!|.i.....3...d(..6..;t<w..5.X2..j|..]r..h.,g4.7Q.R........5....^..j.`.....,.Il8..B..V.....p.1,x.....O'.bz.jN.h"....h.P.....k...?..2..Y.QK.,..(...s...^..`.7.F]..v".~+..t..*...O.....V.......:I.\.....2.1.Ebrmmf.,.".SN5..3@..U.Jx..6.V....a....sutCBrL....4.(...j..H|`dE.....F......./O.=..d.\..g.w.h.e..x..%...../...Z.k~.6.*.0.)P.....K.)...~.d..V.!h..kd.....-.n......%..=...-X7g..*..Zh..2MM.kY.@.uE..d...,)*......z..D(...*%..).....JF.-..*X.w.3G.q..t...~.S..}..Q..u..nR.S.C.....$K..<........ .*...g0..$...tQk.Q.7.R......E_.......$.\.+q... U..4\.>6..!d.p...@w{.>n..nd|...)4.XO...VYwHLTM..n,[l.J..X....i...\.d.$u.......?....lZ....10..f9....Q.0..6d..,j.l..(..r./..O...F...

                                                                                                                                                                                                Chrome Cache Entry: 867

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1555
                                                                                                                                                                                                Entropy (8bit):7.107402048079722
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:T1hfvWwjx82lY2T3iV7vyJ3VzBYGsBq/qnmnTWApAvgBFBDd4WhjDFWyJZm:ZANn2esJ37Yf583eohTlJZm
                                                                                                                                                                                                MD5:12430F012C4B6B4A91C63CBF1369E1FF
                                                                                                                                                                                                SHA1:A8502ADE0C47E23230E5DA9D5658EC1F1DA309D6
                                                                                                                                                                                                SHA-256:079919E3400BA9BC0D569F5634CC41B2FD1B8E7A721B2B473D21F10FE2FA7F6B
                                                                                                                                                                                                SHA-512:17B7564088E12CD64AE79E7179EF4B26941370DC442528CB08320FC0D40BEC88D2B77124624685ACF9BA974467E27A7051703761C6FFFE5468C90217CAC5A4A6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/img/favicon_32x32.png
                                                                                                                                                                                                Preview:.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)" xmpMM:InstanceID="xmp.iid:33B346918F4C11E7946BAB1AFF99627F" xmpMM:DocumentID="xmp.did:33B346928F4C11E7946BAB1AFF99627F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:13441FC48F4C11E7946BAB1AFF99627F" stRef:documentID="xmp.did:33B346908F4C11E7946BAB1AFF99627F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..6.....IDATx..MO.q.....X.B=./H..D...F...^8A........|....^...F...!..H...!.I.`Q.-.8........d.......<..'"....l

                                                                                                                                                                                                Chrome Cache Entry: 868

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (10590)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):30439
                                                                                                                                                                                                Entropy (8bit):5.5760134461382
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:8/86aj6dY8cJpu4MN0As67qVOqIfhE8r8to8p85at48Wpe8KL8s7MiT8PtFvd:87aj59Jpu4MN0As6H5Gt4vhiTEZd
                                                                                                                                                                                                MD5:1166E68035C050F16C75EA7E7545E1F3
                                                                                                                                                                                                SHA1:64648866706E7E1399A760CCC9D55CE393D838DF
                                                                                                                                                                                                SHA-256:783AB3E3239F71E17564BBE24157348E81B2B2C721163BBDF3B5573198601868
                                                                                                                                                                                                SHA-512:5D56C1817508ECE235F56C07356D000AD36EC3886A1EA7EEB66F7B329C415020C36E72B352F924BAAB11D67D580A2D5EBA1DAAC456BC0F1D9430FFA29E8800D1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iYu44/yd/l/en_US/AoO6mdoUQE-.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("GroupsCometMemberProfileLink_group.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"GroupsCometMemberProfileLink_group",selections:[{alias:null,args:null,kind:"ScalarField",name:"answer_agent_id",storageKey:null}],type:"Group",abstractKey:null};e.exports=a}),null);.__d("CometDisabledContext",["react"],(function(a,b,c,d,e,f,g){"use strict";var h;a=h||d("react");b=a.createContext(!1);g["default"]=b}),98);.__d("BaseHScrollConstants",[],(function(a,b,c,d,e,f){"use strict";a=1600;b=10;f.MAX_CONTAINER_WIDTH=a;f.WIGGLE_ROOM=b}),66);.__d("smoothScrollTo",["ExecutionEnvironment","UserAgent"],(function(a,b,c,d,e,f,g){"use strict";var h,i=c("UserAgent").isBrowser("Firefox");b=(h||(h=c("ExecutionEnvironment"))).canUseDOM&&window.matchMedia("(prefers-reduced-motion: reduce)");var j=b&&b.matches,k=(h||(h=c("ExecutionEnvironment"))).canUseDOM&&document.documentElement!=null&&"scrollBehavior"in document.documentElemen

                                                                                                                                                                                                Chrome Cache Entry: 869

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2197047
                                                                                                                                                                                                Entropy (8bit):4.927723246878271
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:NRpaQ+5+Fmt9CKkqFOdJ/JGfeiwtHWTOev3z69JGnez0TDJmgbVrdUXo/4Q/5mxe:lo/4Q/5mxkR510u
                                                                                                                                                                                                MD5:53B794734100B755CFCB365064184E25
                                                                                                                                                                                                SHA1:FD52DBE3B262339F7DC1A4D4724BF29E6B5E648D
                                                                                                                                                                                                SHA-256:27BEEFB6E747263B12FDFB91B1D6F7A0DA96B185BB65A305B6F5F7698745DC6B
                                                                                                                                                                                                SHA-512:9CBD83CF53C7FCA4241F515D32EA3B72A99E4EB6A918C121F0983FC6F51C1F9DCDC7AD8A4006958BB58072F38CD82DF8CC4584434FAABE639012CF77AF8B8E14
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.qd3-7c0_Auc.L.B1.O/am=AAgU/d=0/rs=AGKMywHRwyOY61edhhcCDbJi64vycUQERg
                                                                                                                                                                                                Preview:.lottie-component{display:block}.yt-spec-icon-shape{display:flex;align-items:center;justify-content:center;width:100%;height:100%}.yt-core-attributed-string--inline-flex-mod{display:inline-flex;height:1.4em;vertical-align:middle}.yt-core-attributed-string--inline-block-mod{display:inline-block}.yt-core-attributed-string__image-element--image-alignment-bottom{vertical-align:bottom}.yt-core-attributed-string__image-element--image-alignment-baseline{vertical-align:baseline}.yt-core-attributed-string__image-element--image-alignment-vertical-center{align-self:center}.yt-core-attributed-string__link{text-decoration:none}.yt-core-attributed-string__link--display-type{display:inline}.yt-core-attributed-string__link--call-to-action-color{color:#065fd4}.yt-core-attributed-string__link--overlay-call-to-action-color{color:#3ea6ff}.yt-core-attributed-string--link-inherit-color .yt-core-attributed-string__link--call-to-action-color{color:inherit}.yt-core-attributed-string--highlight-text-decorator .

                                                                                                                                                                                                Chrome Cache Entry: 870

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (4982)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):52506
                                                                                                                                                                                                Entropy (8bit):5.446250274482012
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:ETsMRensj20tJ9Z5Q6K3uwSXiRc0Pj+P3fPO:ETcnsjDJtQ6K3urNajcfPO
                                                                                                                                                                                                MD5:F833E6B292F7240CC8A49C3FCE063EA8
                                                                                                                                                                                                SHA1:193958C5C91BBC902799CFEF02101D5F19ED7F55
                                                                                                                                                                                                SHA-256:FDC143BE95EB2A0348888C7231F2089FA95A1F07D93FABC18D87D314590CE21E
                                                                                                                                                                                                SHA-512:40BEC0871299562048FAF8305BD0C9BA0ABBF53554BB1047DF4474734ABB6700B6924F3ED828AAEAA3DDB9771894046A6907C4D1E166B62796BAFC4D3E89F50C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iFd24/yZ/l/en_US/EbDu0qzCCoR.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("useCometTextDirection",["UnicodeBidi","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=(h||d("react")).useMemo,j={LTR:"ltr",NEUTRAL:"auto",RTL:"rtl"};function a(a,b){return i(function(){var c=d("UnicodeBidi").getDirection(a,b);return j[c]},[b,a])}g["default"]=a}),98);.__d("CometRoundedTextInput.react",["BaseFocusRing.react","BaseTextInput.react","CometScreenReaderText.react","Locale","react","stylex","useBaseInputValidators"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||(i=d("react"));b=i;var k=b.useId,l=b.useState,m={backgroundPlaceholder:{backgroundColor:"xmjcpbm",$$css:!0},backgroundSecondary:{backgroundColor:"x1qhmfi1",$$css:!0},disabledInput:{color:"x1dntmbh",cursor:"x1h6gzvc",$$css:!0},endIcon:{paddingEnd:"xsyo7zv",paddingLeft:null,paddingRight:null,$$css:!0},fontPlaceholder:{color:"x12scifz","::placeholder_color":"x2s2ed0",":focus::placeholder_color":"xq33zhf",$$css:!0},fontSecondary:{color:"xi81zsa",$$css:!0},hideIconAnimation:{transitionDura

                                                                                                                                                                                                Chrome Cache Entry: 871

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):648
                                                                                                                                                                                                Entropy (8bit):4.380679704687561
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noU/vmRfhAZY75jQOglOfYcgUKa1rTdnSbzUMoElCInaGLKphWXpVn1:t4oU/vCOa75cOglOfWUzddnSXkUaGLYS
                                                                                                                                                                                                MD5:3DFBA54305D790EEE8D1ED17694E3796
                                                                                                                                                                                                SHA1:8D0B1DDEE9A50BA3AAA040F11859C2543325C97F
                                                                                                                                                                                                SHA-256:BDBC7B228AFDC12B4290348DEE94F07413262E4EAC967AB91946823E45710748
                                                                                                                                                                                                SHA-512:0FDBB45059C9036353594B3D4F5CEDC908AA5FB332B594D66C654821BFF09E50C739E274B744CFCD5F91ACF2B39D190E2B32EC84697EA9F04FB6A2720F9E7291
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/volume_off/v4/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m3.15 3.85 4.17 4.17L6.16 9H3v6h3.16L12 19.93v-7.22l2.45 2.45c-.15.07-.3.13-.45.18v1.04c.43-.1.83-.27 1.2-.48l1.81 1.81c-.88.62-1.9 1.04-3.01 1.2v1.01c1.39-.17 2.66-.71 3.73-1.49l2.42 2.42.71-.71-17-17-.71.71zM11 11.71v6.07L6.52 14H4v-4h2.52l1.5-1.27L11 11.71zm-.67-4.92-.71-.71L12 4.07v4.39l-1-1V6.22l-.67.57zM14 8.66V7.62c2 .46 3.5 2.24 3.5 4.38 0 .58-.13 1.13-.33 1.64l-.79-.79c.07-.27.12-.55.12-.85 0-1.58-1.06-2.9-2.5-3.34zm0-3.58V4.07c3.95.49 7 3.85 7 7.93 0 1.56-.46 3.01-1.23 4.24l-.73-.73c.61-1.03.96-2.23.96-3.51 0-3.52-2.61-6.43-6-6.92z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 872

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (5842)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):13005
                                                                                                                                                                                                Entropy (8bit):5.385476614866472
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:EGPzF/Z8FjmrWX8oDfc/xkiF55npVKyGT5xRNElQQx0JLNThA+dW51So:Bj8FarWX8oDfcFFDnpVKyGdxRNElB1Ye
                                                                                                                                                                                                MD5:E1AD4E3D26CC72E49609FCAD39B4AABB
                                                                                                                                                                                                SHA1:1D353A2E2E9C24C12A938C9EC8DEC48D87C6C420
                                                                                                                                                                                                SHA-256:9AE20AB072694E627FC333C4514E5429B8BF47477F3886D9D0BE00FA5DCFDCAA
                                                                                                                                                                                                SHA-512:5B7026F39184ACB8CFCBFA4C5528595F209A97E3F2FEFEA752BCAF6D0922A719EAD8706A3C8C42D37EA364B3E9CBACE687D72B0D1BAF614B690D0B14515C45C0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3idBq4/yT/l/en_US/nYVb1eL2wQQ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("BaseToast.react",["BaseInlinePressable.react","BaseTheme.react","BaseView.react","FocusRegion.react","focusScopeQueries","react","useCurrentDisplayMode"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||(h=d("react"));b=h;var j=b.useId,k=b.useMemo,l={dark:"__fb-dark-mode ",light:"__fb-light-mode ",type:"CLASSNAMES"},m={item:{display:"x78zum5",flexDirection:"xdt5ytf",paddingBottom:"x19yoh24",paddingEnd:"xpowjs8",paddingLeft:null,paddingRight:null,paddingStart:"xrxijuk",paddingTop:"x6enp1t",$$css:!0},itemText:{flexGrow:"x1iyjqo2",$$css:!0},link:{wordBreak:"xdnwjd9",$$css:!0},root:{alignItems:"x6s0dn4",backgroundColor:"x1wkzo03",borderTopStartRadius:"x1192kqh",borderTopEndRadius:"xjfsc2c",borderBottomEndRadius:"xg8fqjl",borderBottomStartRadius:"x1kdh5me",boxShadow:"xi1c1fh",display:"x78zum5",flexShrink:"x2lah0s",maxWidth:"x1cs6qxi",minWidth:"x1hqenl9",paddingStart:"xuv3zuj",paddingLeft:null,paddingRight:null,paddingEnd:"xd3owfx",paddingTop:"x192rfv7",paddingBottom:

                                                                                                                                                                                                Chrome Cache Entry: 873

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (4199)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):19218
                                                                                                                                                                                                Entropy (8bit):5.386483333795039
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:audfEIMCVf6W/vtvayL5sDU/SkZKjAUpSiLw9UpYCjIgk9uzBi:ffL6W/vtvawsY/8suSr9UpYCjIgk9uFi
                                                                                                                                                                                                MD5:C8734A39BAC01098267A643B9D728D22
                                                                                                                                                                                                SHA1:33964CFF7039C268CA4432FC3F69A2B096D09D7A
                                                                                                                                                                                                SHA-256:505708C0E484FFF76A2CE4C98F2923DF33AB6D1F6DBCBFAB2AA083F46D78C7B6
                                                                                                                                                                                                SHA-512:18EC4598C30BFA490DBCAE1B73D2E451CD7853458CDD0B7E0473B91F0FA5F6E8E02FA2C504F2D99B4221C0D80170005FDFA3CA3EBFA4DC38EABDC68FDB543DCD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Ou=function(a){this.Ga=_.t(a)};_.B(_.Ou,_.v);_.Pu=function(a,b){return _.gd(a,3,b,_.sc)};_.Ou.Fb=[1,2,3,4];.var ABa=_.da.URL,BBa,CBa,EBa,DBa;try{new ABa("http://example.com"),BBa=!0}catch(a){BBa=!1}CBa=BBa;.EBa=function(a){var b=_.hh("A");try{_.Zd(b,_.Td(a));var c=b.protocol}catch(e){throw Error("cc`"+a);}if(""===c||":"===c||":"!=c[c.length-1])throw Error("cc`"+a);if(!DBa.has(c))throw Error("cc`"+a);if(!b.hostname)throw Error("cc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};DBa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.FBa=function(a){if(CBa){try{var b=new ABa(a)}catch(d){throw Error("cc`"+a);}var c=DBa.get(b

                                                                                                                                                                                                Chrome Cache Entry: 874

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):211
                                                                                                                                                                                                Entropy (8bit):4.924417291349329
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4mqUEUKFI8mRKuw6Y8:t4noU/vmREaI8Kw6Y8
                                                                                                                                                                                                MD5:DBF72CAC4571210883C7748A6E8B9C71
                                                                                                                                                                                                SHA1:984DFE134C779FD952ED67C1CEAB88D14FDCF122
                                                                                                                                                                                                SHA-256:62714BADF737F2D069588724ADE1CB6B79AEF821C432875C614997E351F76341
                                                                                                                                                                                                SHA-512:AD53CBDD55542FCCD83387639BAD59372949B1933F603B44EB6859F1EB344B8F2F11241EC954628F9025E88CB308F67051C408151800176B45F49A398140744E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/clapperboard/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM5 9l1 3h3L8 9h2l1 3h3l-1-3h2l1 3h3l-1-3h3v11H3V9h2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 875

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):473
                                                                                                                                                                                                Entropy (8bit):5.240157994693449
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:kxeXjxeX4wFbcloiHKobO4xMl23ZhVgBDKDi7e8kbRNfeX60:kMYDRiqobPxi2fVgB+XprGJ
                                                                                                                                                                                                MD5:13782B3B1A5B6B82B186225398C96C55
                                                                                                                                                                                                SHA1:AA9E89FABF00C27173190096499F47FAEE56C684
                                                                                                                                                                                                SHA-256:1EAF3863ADA2FC1BC5C99F0731313B8046C576403EC8721757F935B8245C2C26
                                                                                                                                                                                                SHA-512:D966BA31E97827381C2F26E9DC069A6DA26EFFEE26AE9C1965A73C1CFB4A852A6F4C94BF60B1F33719A3AF522CA0B868D99833E422FDEAD8644BD527118AE685
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=XiNDcc"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.HIa=_.y("XiNDcc",[_.Nna]);._.k("XiNDcc");.var DI=function(a){_.J.call(this,a.Ha);this.aa=a.Ea.ez};_.B(DI,_.J);DI.Ba=function(){return{Ea:{ez:_.CI}}};DI.prototype.kB=function(){_.b3a(this.aa)};_.K(DI.prototype,"IYtByb",function(){return this.kB});_.M(_.HIa,DI);._.l();.}catch(e){_._DumpException(e)}.}).call(this,this.default_AccountsSignInUi);.// Google Inc..

                                                                                                                                                                                                Chrome Cache Entry: 876

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):76716
                                                                                                                                                                                                Entropy (8bit):7.985483199497838
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:4/NSOMxCBpaceiqT9FDVXGoAzffk7Yc/JF6Io/:4/NZZBpte/T9FDVXGzzfsXRFS/
                                                                                                                                                                                                MD5:87F68CBEAA076F907E0021D353F7407B
                                                                                                                                                                                                SHA1:698FC144276D39379B3892067517A4BFBFE3FB25
                                                                                                                                                                                                SHA-256:C72A5BD5F5B6053FE40631A4C94A36CC8B5DFB3D530174A7A73CFFDAEC87BB01
                                                                                                                                                                                                SHA-512:B96122B5996095DEB34F0BF816900BE6EC118F2918AB1A52904B1A0B42F426ED30AED9E0FE187152F443F4ED1BB86D52F467361C92BD48FDE73FD82AFDF93C07
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/423532108_3376307412667808_8091808659321521448_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=URwafMLgwnYAX9jMT9G&_nc_ht=scontent-lga3-2.xx&oh=00_AfDCEMtjk8RMKDzNN9QalGfk-XcsGMLw5zAsPr_hTSIqog&oe=65D328F7
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100003c200000cc500000265400008157000016840000f8bd00002ac40000e7c90000a7cf0000ac2b0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."....................................................................................B.G..I.8.qT..p.......=.X....-@..U<\.S(.qO6I.......ey....r)hP`.,$..p.Q....E.4.d.@.... jD...4.....(.4....1!g.....A0...h...c..).ZJ..L......8.. O...X..lC8..:7......h..D`....1)q"@.jI..8"q*.(...+M...Iu1.4......@...t.Y.Emjj.Z` ..Pl.&......K.V...O.....Us......q...\Fhq.+...Sj..h....$.A...%r...I5R@.(. ..6.3A*)t.#...Fda.`#jV).........b.J,Z..4.#.B...Q.eZ..\....D%.+...E.,..Gy.H.0."....1f..K.ejt.S..Y..D..-.,..AJ.q.L6..M6.gFhR.Mc..&..5..X....!U6.@+.6...I2R.<J.JE.J.IM...9.N..Zwsd..4.U:.%.#....vv.O..]...H..u(.-..B.'M>.....n(y<...Y..&iHR..K.6..n.....,.2.+"..@=BC..#m..R<.m..l....8.Ir4.q.L....P.s..69.i%

                                                                                                                                                                                                Chrome Cache Entry: 877

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3021
                                                                                                                                                                                                Entropy (8bit):7.830922303839052
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:UbRKGEp+jbQgv//kHTbeaD9QWsMBhuqyezdxtmzIf3unMMs34pG6kYZmEJuv:nsbv/22g9jskhPNzDts8IMjWhXO
                                                                                                                                                                                                MD5:82532211244DF32112C5EB73AFA9C256
                                                                                                                                                                                                SHA1:3B017B53B3F13ABB988321ABDB476CF18EB49EDB
                                                                                                                                                                                                SHA-256:22AA67FEB4AD820AD0C30735D58DA180E414EB584202E084CFDED6F84FF7CCED
                                                                                                                                                                                                SHA-512:85ED181A5F3D6F402F677029CA44BE729AE58AFA03CD035C8DEEF2DC69761B297C6BB298F905923662D97FAFE1D16AE8010054E05FBDAD57EE09874C5B175AEE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/ytc/AIf8zZSEXyqHebKkrljcsAfcxYjFtZPXD2nc6I4JcYAw4Q=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D..........................................;..........................!1.."AQ.aq..#2....Rr....$3BCb.................................2......................!..1AQaq."B......2....#R..............?.......7..<&.FB.Hk....J.[...g....?P...#.TC......i)e..-..w?.......u.Y...O.A./c...6.i#...k....?...\.....U....[\.o;..... ...,....;......AU4...y%.!J-.....Z..uo.O2@....6..K<..(.eQ...'... ..7........9..E..I.-...aZ.#4..Vm.}l:g.B..eM..6.m.../...6.....*.........Z.W........n8.......2...Cj....i.4. s...2.#....g....sv.. ....o..?..y.........Z4~)Z.r..h....).8....1.F...'..nW.i.....6.u7.6..V..lp`UHD....N....S&..-!Ps...k..!..v..PYx.......18|.s.E......$.|.....O..L.b...,..,.I...@M.[...D..X......jMc.m]r.....#...-..8..M.........5....H..?.>.d.).....A{. ....A.f.

                                                                                                                                                                                                Chrome Cache Entry: 878

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                Entropy (8bit):3.875
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:HmnY:OY
                                                                                                                                                                                                MD5:C13E70783B272C1B1F38DF78789CB038
                                                                                                                                                                                                SHA1:7F182E8DA5EE7FB00A151AC0D205D71E9C017D94
                                                                                                                                                                                                SHA-256:8800EFDDF6F05E9F2F4263946E6C5AB296C955138B006CE3A74D3B0F143BE92A
                                                                                                                                                                                                SHA-512:A7F5941549D283934D49EE8BF8FA069D387FBDF3BBB86F884F14FD4E10EB5F6E754F55E0F3F94DCE79EF84FA2787A5F9DB8A24C74BA13BAF379DB66BF35FB8F9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAk8yq_jFOmFmxIFDfGjW-M=?alt=proto
                                                                                                                                                                                                Preview:CgkKBw3xo1vjGgA=

                                                                                                                                                                                                Chrome Cache Entry: 879

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (18915)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):43237
                                                                                                                                                                                                Entropy (8bit):5.680707641754852
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:5RWw2BBHWtPd0h3A4LWhNzrXNAtU9ArbM+AI99yNIE:5QBZWtmw4LqPXNIU9ArbMP
                                                                                                                                                                                                MD5:A20A57297296210AE55C26306436FCE5
                                                                                                                                                                                                SHA1:AF8363C369F8FD23868093CE0FF02C8D88C229C0
                                                                                                                                                                                                SHA-256:2DE52103B1FEEB037AF1757A1D10CB77A335258410AFF50F3CC4B93589357FDB
                                                                                                                                                                                                SHA-512:E0BD233E5F75ECCC4D5018E1F7A4650D13BDD84D4DDCBB1BF482CB35CC836B85CE146F0A2B41DEA578CECF05FB8E7A6C9B6F28DC79A81801A9898B700860020C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/../**. * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/. */.__d("bignumber-js-9.0.1",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b},h;function i(){(function(a){var b,c=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,d=Math.ceil,e=Math.floor,f="[BigNumber Error] ",i=f+"Number primitive has more than 15 significant digits: ",j=1e14,k=14,l=9007199254740991,m=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],n=1e7,o=1e9;function p(b){var g,h,x,y=a.prototype={constructor:a,toString:null,valueOf:null},z=new a(1),A=20,B=4,C=-7,D=21,E=-1e7,F=1e7,G=!1,H=1,I=0,J={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xa0",suffix:""},K="0123456789abcdefghijklmnopqrstuvwxyz";function a(b,d){var f,g,j,m,n,o,p,q,r=this;if(!(r instanceof a))return new a(b,d);if(d==null){if(b&&b._isBigNumber===!0){r.s=b.s;!b.c||b.e>F?r.c=r.e=null:b.e<E?r.c=[r.e=0]:(r.e=b.e,r.c=b.c.slice());retur

                                                                                                                                                                                                Chrome Cache Entry: 880

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 21464, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):21464
                                                                                                                                                                                                Entropy (8bit):7.991635778215233
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:384:kNMw20ZcZdIR049weTGXkBXju/W4irYjhPC09oOtbMDa9HVZycTvwxNTGup:UaxmXXSdiQPCjMvyugNiup
                                                                                                                                                                                                MD5:923A543CC619EA568F91B723D9FB1EF0
                                                                                                                                                                                                SHA1:6F4ADE25559645C741D7327C6E16521E43D7E1F9
                                                                                                                                                                                                SHA-256:BF7344209EDB1BE5A2886C425CF6334A102D76CBEA1471FD50171E2EE92877CD
                                                                                                                                                                                                SHA-512:A4153751761CD67465374828B0514D7773B8C4ED37779D1ECFD4F19BE4FAA171585C8EE0B4DB59B556399D5D2B9809BA87E04D4715E9D090E1F488D02219D555
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
                                                                                                                                                                                                Preview:wOF2......S...........St.............................*....`..~..<..u.....H........6.$..|. ..r..K..........V...@yF#b...>.[<;P..@*.....OINd(...T...C..T.w.s.b..$.....6+. ....R8E$..o..f."MD.@T"...fH..fX..O....AA..F*....+v.Q(KpXF..U"..x@...3|l..E..<.O..~..5M}.".q.#Y9....c.o.s...M.Cr..Dt.,..CtI.O..{D......H..*.+>*K..:.Y..-.l.v......'.....^.Y.k..E..c..~..S..P0.@.....<.!(.P.u.g.2....y..y..Z...v.^..lu.dC.a..o....{.o....h3A.K.I..-.O,..}.c>....Q1]....($..........s..b.X..........CJ.+..4.gE4T.S.*{g......(^...bA,...~..R..p...<G."..y.G...k..*'...i.u....I..S....\.......e$..m.2...{K........V......{me.%.}...P3...{.T..i..Av...K..g.... ...R..n..{m....t@Z....1A.H.2...^..R5)..4}..(...T......=...Pg...Y....y..e.$...]U..0.....8..Fs.(..O.....&..f,g..5..1.yo9..:cy...e..A.......i...i...G..4`)..#j.<+..{ai..[..[~.(,......X......3.f.m+3...B......_D.F.X.i.Y#.X......}_.d..`.i..i......T...7v..A.......?..c..~..g..w.D.H)%..B.!.......:.....ZE{........m.FN.....k...0.X...

                                                                                                                                                                                                Chrome Cache Entry: 881

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 189 x 181, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):7289
                                                                                                                                                                                                Entropy (8bit):7.85997289674361
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:lCRDz8VAQEISzCSFRqJwUaAJN7VK97XN+3xii36e:lUq4IeJUN5K97NgN36e
                                                                                                                                                                                                MD5:E8D1B4455B9ED73DABB444AF813E0FD7
                                                                                                                                                                                                SHA1:FD99452B6FAD2E0D3C39FF17787A1849D3BB3CB7
                                                                                                                                                                                                SHA-256:B6D482EC59580B5BF80DAEC00E55656212867ACB26F09A0BB6173AFA3C45C4DC
                                                                                                                                                                                                SHA-512:4B7F5E5F9AC922A3EA337E3C50A2487BE41189AE92D3CA299E702815A7882116F07B8E9EAAB812C4A9986EA0186264A6613D531189438FF105458188FB323A9F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/WfXPMghq_2a.png
                                                                                                                                                                                                Preview:.PNG........IHDR.............=Z.o....PLTEGpL...........................................................................................................................................................................................................................................................................................x..........5@T................................................(((.............................................................v.............................w..........................w......................................x............................... ...v..w...................................................................................w..w..w..w...........v.................x..x..w..............w..w..y..v.................w..v..w..v..w.....w..w..w..w........w............./..q....tRNS........>..........H.8Z......f...0.d..p$.P...~..v..*M....^.,.TF&6.....kB~a.\:.......xrz..,.?"....<.J..5......@. .mW..~..........J..2.P.z.4s....@1......Xa(...hF.R...e.

                                                                                                                                                                                                Chrome Cache Entry: 882

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):341
                                                                                                                                                                                                Entropy (8bit):4.845385553639442
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohgqWHiA4vmI4lAwuQgQIVY6Wqx5Xt6M0TRcmQTIfyuETUrNmraXnPt:t4noOAvmRHnIq6JmM0T7QobETUrsOpk8
                                                                                                                                                                                                MD5:A83C2EDA381FB2C86BE7587C8D53C330
                                                                                                                                                                                                SHA1:ECA052D4491403B1731D2FA36176CDAA4DD76F11
                                                                                                                                                                                                SHA-256:B011A7CD5658F11324619697CE2EA15178B057622074AE6CB687A0E95D978EC2
                                                                                                                                                                                                SHA-512:03C807382DC1320EFE94B3B47F30988F9153DDB655245139ECF40D90C97760FBCCFB117933736137BA4280D8964896B0ABBB64278BDA324A75BA7CD27557FDBE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/fashion/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 883

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):274
                                                                                                                                                                                                Entropy (8bit):5.064374319451513
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4LyS7NHTZORTIhRJUTT6kg2AfI1NIfdAf7:t47N9U/vmRLy2NHTsYffLV6
                                                                                                                                                                                                MD5:A2ACF270DAF56F6484C50C1F74C5B676
                                                                                                                                                                                                SHA1:BD3B6DB51B936C0D49E293CB482CC2839A0D7D94
                                                                                                                                                                                                SHA-256:DB8400A38C08118E2FD10E60F84A2B4DE09A64721A665E23C37E03F092F41F94
                                                                                                                                                                                                SHA-512:6C94E190FA493AF676930E76713C5511FAD174C62506C7988072044C217ACC83847E8BCB4CC873A8B2B29D7B9FCB90CFE48336FB2450CFD7AE34C4F9C02A6CD8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/news/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M11 11v6H7v-6h4m1-1H6v8h6v-8zM3 3.03V21h14l4-4V3.03M20 4v11.99l-.01.01H16v3.99l-.01.01H4V4h16zm-2 4H6V6h12v2zm0 7h-5v-2h5v2zm0-3h-5v-2h5v2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 884

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2134
                                                                                                                                                                                                Entropy (8bit):5.507213070755754
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:8OLNKWMOLNKNFFZLOLNKE3JOLNK33OLNK4RVc+u1OLNKPN0oD:8OLNKWMOLNKXFZLOLNKE3JOLNKHOLNKt
                                                                                                                                                                                                MD5:81EEF3A68E6EA5131932245EDB5E75E2
                                                                                                                                                                                                SHA1:06A1E2FE3FEC268FD69122D8B2DA67ABA8EBBF56
                                                                                                                                                                                                SHA-256:F195EADE4059E1446EEEB8C16C8FDB17A540C2243AE3A37B63D55C4D93971382
                                                                                                                                                                                                SHA-512:261D5619A6FD2DAA3D125664F0F0B8CA85F6648AA544C3F04ED6489F29B1C8E70106525C3F498826D60F41C83E68C6968B5A51312D31E6CF39EB4EA03E4752A2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.googleapis.com/css?family=Roboto+Mono:400
                                                                                                                                                                                                Preview:/* cyrillic-ext */.@font-face {. font-family: 'Roboto Mono';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v23/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_SeW4Ep0.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto Mono';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v23/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_QOW4Ep0.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek */.@font-face {. font-family: 'Roboto Mono';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v23/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_R-W4Ep0.woff2) format('woff2');. unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;.}./* vietnamese */.@font-face {. font-family: 'Roboto Mono';. f

                                                                                                                                                                                                Chrome Cache Entry: 885

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (574)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3448
                                                                                                                                                                                                Entropy (8bit):5.484698692620344
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:o4Mjf+vi2hHGMmBUJFXtDaD6U81+K/tmbwTnw:0jf4fJLMhkdlah
                                                                                                                                                                                                MD5:C01A82AB927B56E6B5FA01F6CB78D8F7
                                                                                                                                                                                                SHA1:7C612A2A522DDD882C1DE037C38CFD0D05F6272D
                                                                                                                                                                                                SHA-256:11DB1E8D29DE3DA2678D53580C87CF5B9874BF842B7919861DE31FB1ECCA18E5
                                                                                                                                                                                                SHA-512:BE4366035AC2A2764A4557D4011EEBB5A339FA7C2214322F0293D516ACAD2E12CA4E9B6752B0CCE7D1581A17362835AA811EE7D8261D38204383736E1C9C49BB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var lsa=function(){var a=_.Pd();return _.Hi(a,1)};var qq=function(a){this.Ga=_.t(a,0,qq.messageId)};_.B(qq,_.v);qq.prototype.Ja=function(){return _.gi(this,1)};qq.prototype.Wa=function(a){return _.Pi(this,1,a)};qq.messageId="f.bo";var rq=function(){_.Lk.call(this)};_.B(rq,_.Lk);rq.prototype.Tc=function(){this.yO=!1;msa(this);_.Lk.prototype.Tc.call(this)};rq.prototype.aa=function(){nsa(this);if(this.Ez)return osa(this),!1;if(!this.EQ)return sq(this),!0;this.dispatchEvent("p");if(!this.aK)return sq(this),!0;this.NH?(this.dispatchEvent("r"),sq(this)):osa(this);return!1};.var psa=function(a){var b=new _.En(a.I_);null!=a.kL&&b.aa("authuser",a.kL);return b},osa=function(a){a.Ez=!0;var b=psa(a),c="rt=r&f_uid="+_.Rg(a.aK);_.jl(b,(0,_.sf)(a.ea,a),"POST",c)};.rq.prototype.ea=function(a){a=a.target;nsa(this);if(_.ml(a)){this.JF=0;if(this.NH)this.Ez=!1,this.dispatchEvent("

                                                                                                                                                                                                Chrome Cache Entry: 886

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (4199)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):19218
                                                                                                                                                                                                Entropy (8bit):5.386483333795039
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:audfEIMCVf6W/vtvayL5sDU/SkZKjAUpSiLw9UpYCjIgk9uzBi:ffL6W/vtvawsY/8suSr9UpYCjIgk9uFi
                                                                                                                                                                                                MD5:C8734A39BAC01098267A643B9D728D22
                                                                                                                                                                                                SHA1:33964CFF7039C268CA4432FC3F69A2B096D09D7A
                                                                                                                                                                                                SHA-256:505708C0E484FFF76A2CE4C98F2923DF33AB6D1F6DBCBFAB2AA083F46D78C7B6
                                                                                                                                                                                                SHA-512:18EC4598C30BFA490DBCAE1B73D2E451CD7853458CDD0B7E0473B91F0FA5F6E8E02FA2C504F2D99B4221C0D80170005FDFA3CA3EBFA4DC38EABDC68FDB543DCD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Ou=function(a){this.Ga=_.t(a)};_.B(_.Ou,_.v);_.Pu=function(a,b){return _.gd(a,3,b,_.sc)};_.Ou.Fb=[1,2,3,4];.var ABa=_.da.URL,BBa,CBa,EBa,DBa;try{new ABa("http://example.com"),BBa=!0}catch(a){BBa=!1}CBa=BBa;.EBa=function(a){var b=_.hh("A");try{_.Zd(b,_.Td(a));var c=b.protocol}catch(e){throw Error("cc`"+a);}if(""===c||":"===c||":"!=c[c.length-1])throw Error("cc`"+a);if(!DBa.has(c))throw Error("cc`"+a);if(!b.hostname)throw Error("cc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};DBa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.FBa=function(a){if(CBa){try{var b=new ABa(a)}catch(d){throw Error("cc`"+a);}var c=DBa.get(b

                                                                                                                                                                                                Chrome Cache Entry: 887

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):221
                                                                                                                                                                                                Entropy (8bit):5.051880229825864
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4Bo0NiGcrlSnfa9I7LKY:t47N9U/vmRBo0crlsfaq7n
                                                                                                                                                                                                MD5:83D9AAA5E179D445E561E8167CEB4D7A
                                                                                                                                                                                                SHA1:CBD241357B025084C9B107CC5ED0803B0A776C3B
                                                                                                                                                                                                SHA-256:AA910C07266E14040CA7215E0070769E61A15B724868E1060AE081E8160AB25D
                                                                                                                                                                                                SHA-512:9071196C5F5CB17BEE54A65712CE1CA63BFDE00EB7892B9056028854C010C57F4BFE59526512266BD11910D65D834425CAEB08529479F96CB52BC49ABC94A48E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/home/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m12 4.44 7 6.09V20h-4v-6H9v6H5v-9.47l7-6.09m0-1.32-8 6.96V21h6v-6h4v6h6V10.08l-8-6.96z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 888

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):251
                                                                                                                                                                                                Entropy (8bit):4.807326238374636
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4hLBIl/qVs+RLjUjUX:t47N9U/vmRYiVswfUjUX
                                                                                                                                                                                                MD5:05A720716D71F9F56D6C0E5C4B47680A
                                                                                                                                                                                                SHA1:D24611C11E8CC3B158EB518F2298D1E35CE03E48
                                                                                                                                                                                                SHA-256:B90706D55C1E8B616BF8D677C195D09AF8AA75BC669BA3A36A25480CA86F6926
                                                                                                                                                                                                SHA-512:D0DA0CCC993DB255F96AC9CCDDA35DAADA2928F17A1262F5954B6A3C54B57080544E5A9C3808275749ED15A118AAA9B44B50B0AD8A1F2BE668F9D7614A0456B1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/x_mark/v4/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m12.71 12 8.15 8.15-.71.71L12 12.71l-8.15 8.15-.71-.71L11.29 12 3.15 3.85l.71-.71L12 11.29l8.15-8.15.71.71L12.71 12z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 889

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):367
                                                                                                                                                                                                Entropy (8bit):4.678729266974906
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4uZBPeRPbmcsstyLTngAV99WTc6XzQuJ3/vh7QrS3/IUp+wb:t4noU/vmRyPeR9YngQ9Ec6jhJ3XBAUp5
                                                                                                                                                                                                MD5:A28E7BAA1C8C78EFFBDB2D0AB01D9EF3
                                                                                                                                                                                                SHA1:F3408C777CFED5C38AF966596750F675637B012E
                                                                                                                                                                                                SHA-256:7A7A47330CB72F09686EDF979205FA844FA134556F81F046EFECF07B1401A557
                                                                                                                                                                                                SHA-512:14AE281980FA9715DFFF5BB4F22EE6B4959F3C15355B71AA65E43392E598F40DFFDDFBC0670D02D29A7C7A238B0066064174385439D0291275FAEDCE26808146
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/bag/v4/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7 8c0 2.76 2.24 5 5 5s5-2.24 5-5h-1c0 2.21-1.79 4-4 4s-4-1.79-4-4H7zm9.9-2c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44-1.73 2.01-3 3.87-3zm7 17c0 .55-.45 1-1 1H6c-.55 0-1-.45-1-1V7h14v13z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 890

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):251
                                                                                                                                                                                                Entropy (8bit):5.1580903557505975
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohgqWHiA4vmI4hi6Dd7kC0qmjWpYp:t4noOAvmRnJ7l0pWpYp
                                                                                                                                                                                                MD5:931DADAA2F58D46D80735C58183888D0
                                                                                                                                                                                                SHA1:FDB576A133B05B9E28D71E7901B1971CB0335A7C
                                                                                                                                                                                                SHA-256:D59C1758BAFD761AC0CFAE8C33F29DD4F1229F6369E4C36FB3DF9C2DAC2E394F
                                                                                                                                                                                                SHA-512:D4C09F78A450717FEF762941DD897AD5CB3BBE23308E9092DC23E872285F3A17E74FDCCE4492E1ADFAEA0DB2C57229A7469F02816DF5D10092CCFEF26B5F6728
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/video_camera_add/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M14 13h-3v3H9v-3H6v-2h3V8h2v3h3v2zm3-7H3v12h14v-6.39l4 1.83V8.56l-4 1.83V6m1-1v3.83L22 7v8l-4-1.83V19H2V5h16z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 891

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (4850)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):101833
                                                                                                                                                                                                Entropy (8bit):5.456236247309575
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:nTZPXcX3Z5iHe5kZJswsSHrVKDnPYCrkuKG2TI:nTlXS3Z5SemZXsSHrVKD/4uKG2TI
                                                                                                                                                                                                MD5:B3504D9516B8FF198ADD9EC1C4D72DF5
                                                                                                                                                                                                SHA1:8CBB7A417C2E62868AC4063AB3C0224F3F854ADC
                                                                                                                                                                                                SHA-256:8C2B539D75D412592B0C63DA5FA636C3C049137445759ADC09794F12524116F4
                                                                                                                                                                                                SHA-512:E33ADFF95BF6F9E6A2DD4EEB57511EB7C011FE0787BB6A15451FF46FD4162FEC8B11227DA5A546E72C1E36248BAD13DB0864F4B4318D97C618BBDC68BFDEE7C2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3icUr4/yS/l/en_US/D-P_5E-d4iA.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("TahoeTypedLogger",["Banzai","GeneratedLoggerUtils"],(function(a,b,c,d,e,f){"use strict";a=function(){function a(){this.$1={}}var c=a.prototype;c.log=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,b("Banzai").BASIC,a)};c.logVital=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,b("Banzai").VITAL,a)};c.logImmediately=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,{signal:!0},a)};c.clear=function(){this.$1={};return this};c.getData=function(){return babelHelpers["extends"]({},this.$1)};c.updateData=function(a){this.$1=babelHelpers["extends"]({},this.$1,a);return this};c.setChainDepth=function(a){this.$1.chain_depth=a;return this};c.setChainingContextIdentifier=function(a){this.$1.chaining_context_identifier=a;return this};c.setEvent=function(a){this.$1.event=a;return this};c.setIsAutoplaying=function(a){this.$1.is_autoplaying=a;return this};c.setMediaID=function(a){this.$1.media

                                                                                                                                                                                                Chrome Cache Entry: 892

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):442
                                                                                                                                                                                                Entropy (8bit):4.813019877520226
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noOAvmnqtXy+R/Ro1ImoXHNR50buAD2NfnRimbf:t4o7vNC+R/cImoXHN1Nf
                                                                                                                                                                                                MD5:8508DD8336C60695AFCF1158C2EF0EF2
                                                                                                                                                                                                SHA1:32CC87A7AE016449C6038284CEDDBA3E3D0B1791
                                                                                                                                                                                                SHA-256:DEBC90222AA11F028051B9E116A7AD054ED560854FB326A5C38254DA354CFDEF
                                                                                                                                                                                                SHA-512:35DE791E5CE1F47AD1FF89A594DB6FE055920481ED73001EAB97C12A7DC31077A6C5B64740FBFC682923BD98149F4A67AD0C027532EA1BF7EAA3C4D45579E930
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/arrow_time/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><g><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM22 12c0 5.51-4.49 10-10 10S2 17.51 2 12h1c0 4.96 4.04 9 9 9s9-4.04 9-9-4.04-9-9-9C8.81 3 5.92 4.64 4.28 7.38c-.11.18-.22.37-.31.56L3.94 8H8v1H1.96V3h1v4.74c.04-.09.07-.17.11-.25.11-.22.23-.42.35-.63C5.22 3.86 8.51 2 12 2c5.51 0 10 4.49 10 10z"/></g></svg>

                                                                                                                                                                                                Chrome Cache Entry: 894

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                Entropy (8bit):4.362961159354576
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:bh6G3XWZNDrMyMcbtugSUhdei3XWZNDrMyMcI:bnXS5JtpnS5O
                                                                                                                                                                                                MD5:F71C4EFD36879E28A721AAF93B559B3F
                                                                                                                                                                                                SHA1:2AA52C4FD618680148F935B280F96496EFD7E153
                                                                                                                                                                                                SHA-256:F39FC3D962FAE023EBB725DFDBA524226C593C6EB2BC2C1F23C454D63CC10EC2
                                                                                                                                                                                                SHA-512:8EB53CB46F668813C99768F701C00D1E2FF18FFE86F50C0C0A17DFAC06B339DCB513F58972CDEDB5A372035596806F69F50E5F6228B5F0AFE5992E13AADE080F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwkbMnFS9SzlUhIFDYOoWz0SBQ3Fk8QkEhcJsA2cf48--pcSBQ14bxIZEgUNxZPEJA==?alt=proto
                                                                                                                                                                                                Preview:CiIKEw2DqFs9GgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCiIKEw14bxIZGgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgC

                                                                                                                                                                                                Chrome Cache Entry: 896

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (512)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3292
                                                                                                                                                                                                Entropy (8bit):5.170624833123117
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:wetxH4bqSgQQQ22prcGv33N1H3B0Ju7W/U:LwQQaojV
                                                                                                                                                                                                MD5:2CFAE3B8B5153607A7F61A251B3FBBA6
                                                                                                                                                                                                SHA1:C5B4D9055813543D75506AD461C0376EE7FD9627
                                                                                                                                                                                                SHA-256:82316B6A2D5FB055A3A2C81D6E8B15C3C90319109A2C2EBF81D1EAD0E4C027D5
                                                                                                                                                                                                SHA-512:FD0DBC0CC785FD6458CD651C4CFAAB44C8E9722F98F3D7B4ADF5ED8E35483A3F703DA7C609729167DF081A8EA33AF3C01A7170CCB4E1B171BCBDAAF303B4930A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/inline_preview.js
                                                                                                                                                                                                Preview:(function(g){var window=this;'use strict';var Qsb=function(a){g.V.call(this,{I:"div",S:"ytp-inline-preview-ui"});this.C=!1;this.player=a;this.T(a,"onStateChange",this.z2);this.T(a,"videodatachange",this.A2);this.T(a,"onInlinePreviewModeChange",this.b8);this.B=new g.Ou(this.v2,null,this);g.N(this,this.B)},J6=function(a){g.OV.call(this,a);.this.j=new Qsb(this.player);g.N(this,this.j);this.j.hide();g.zU(this.player,this.j.element,4);a.isInline()&&(this.load(),a=a.getRootNode(),g.Zu(a,["ytp-inline-preview-mode","ytp-no-contextmenu"]))};.g.w(Qsb,g.V);g.k=Qsb.prototype;.g.k.show=function(){g.Pu(this.B);if(!this.C){this.tooltip=new g.bY(this.player,this);g.N(this,this.tooltip);g.zU(this.player,this.tooltip.element,4);this.tooltip.scale=.6;this.Zd=new g.rW(this.player);g.N(this,this.Zd);this.j=new g.V({I:"div",La:["ytp-inline-preview-scrim"]});g.N(this,this.j);this.j.Ja(this.element);this.T(this.j.element,"click",this.w2);this.D=new g.VX(this.player,this,300);g.N(this,this.D);this.D.Ja(this.j.

                                                                                                                                                                                                Chrome Cache Entry: 897

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):153
                                                                                                                                                                                                Entropy (8bit):5.109321191076272
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb58FpErFuH4VNX1X3MHqllPrErcHG8ih5SbBdTdUREygEPBiv:tI9mc4sl5RISmK3DEqFhFRWUEJM
                                                                                                                                                                                                MD5:24A230CF90D6B94FB985450DF0FE5B42
                                                                                                                                                                                                SHA1:2E85AABAF518A88729C540D7B71C1F25DB3A54B4
                                                                                                                                                                                                SHA-256:138C2676B4C6DFF51D3D5B6AD11459AEDEA9BD19E34B99B652C454636E377735
                                                                                                                                                                                                SHA-512:A4232A5278AA188D9614C7282400C85317DBCA7CAA685BC1FBAEED8B9B8223EBB3E78D4112A6DD783CA2C6D62BE4831779CF7ED5346A3E1DBB1191810A776845
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_download/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path d="M0 0h24v24H0z" fill="none"></path><path d="M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z"></path>.</svg>.

                                                                                                                                                                                                Chrome Cache Entry: 898

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2887
                                                                                                                                                                                                Entropy (8bit):7.812359975728933
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:Uj8yZGXZJR0NH2gMKyRZErmXbIjbn061qrEl0T76mm5AA/hO+M5jK:88ZZJgu9RZ3I11q20T7chME
                                                                                                                                                                                                MD5:1CE7A6BFFA1E9B0DA4882C2120643DD6
                                                                                                                                                                                                SHA1:BB4B76A9B432C22CBAEF09660294F5D573011F07
                                                                                                                                                                                                SHA-256:E74082B681E124F1A890458038AAEDDE58C4B27E749618D838AD6813D8CBC254
                                                                                                                                                                                                SHA-512:75E20B85971F55CA35CE525F45E6F4EBBCA338C1429FEB5C1F40B36CEDF4F90F34E97823E7EE6A4EF1D4BA2C09FF55FCC718235CFD64E329A60A81037E905D9E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/ytc/AIf8zZTQYDi4hq7st-KjpDBUtNfpJPDuvJEpuNrFvdhqNg=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D............................................4...........................!1.A."Q..a.q..#$23BRb...................................5......................!..1.A."Qqa...2...#Bb...Rr...............?........k.Y5~.....7....r.*.s..B..*Sv....TsRb|}.E...{.....~...Q......t2uV8..J....*..#.dF.F=.........=.k.n.*.Q..D..~...)r|~~...t>E,jt.f+...g......&.o[.B.E....s.."....vj.OnM...H.m.......V..?..,2....;,Q..$...$.i...!B.[.+...*K$.#.N.m..o......$..>...v.v.....`.`...X..A...U..'....b8.|9~..Q.=..&.I={..=.@..tv.nK.V3..#.(..x.o..E.(...g.....,a....A...=.Y^h...J......pu.......|.;*#b........Gj|..{..iK......m....t.t.;0..U(..Y.C...4.4..Yc..............[&Fc$.s<...M..c.|_.?OM+.'m.W...1.s!-.e.x.H....T.m.|..Eu....|......~.l23......A.r...J.%.F.....4..5.v1.O/.]O./0.K.<....v.M...y..e..5M...z.

                                                                                                                                                                                                Chrome Cache Entry: 899

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):38674
                                                                                                                                                                                                Entropy (8bit):5.373344735979869
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:AOZQqlnxITA3+sypwDMBub/6rur81gE0idWSBiHLztbyHgNkmtCgs+FwtNmle:efY+3g/br8qaWSBiHLRGHEbtCgKJ
                                                                                                                                                                                                MD5:9FB0BDB3A292F495914A785280685816
                                                                                                                                                                                                SHA1:2FBAC1566F42B41D336C3CEF46085A8ABA5291F4
                                                                                                                                                                                                SHA-256:8B94EC92B902A78BB5DCF8A9A5CF00B3F693738608FE110FF77A2E90FA62AA09
                                                                                                                                                                                                SHA-512:94E76518978E828E0EAA8B95C807E55DBF4E0EBA201FF5057906482AD5F57D2D2A6BA98F0EE16476688E3B5013525D06EAED692C6B795DAAE635F67B8CD100F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.moa=function(a){var b=0,c;for(c in a)b++;return b};_.noa=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ka(a)||"string"===typeof a?a.length:_.moa(a)};_.vn=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ka(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.ooa=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ka(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.zb(a)}}};.var poa,soa,roa,qoa,Ln,Nn,Eoa,voa,xoa,woa,Aoa,yoa;poa=function(a,b,c){if(b)re

                                                                                                                                                                                                Chrome Cache Entry: 901

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1527)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):14991
                                                                                                                                                                                                Entropy (8bit):5.444433315291858
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ZlS0EjmIMEsYGWLoJo2QFKfnuRBwgm8g0S94dMJ9jH5f/GfAg8NI:U7XxLWzQFK/mWg7g0XE3g
                                                                                                                                                                                                MD5:FDC9B5A35CD74FFF3EA372B1A0027A72
                                                                                                                                                                                                SHA1:F1E0E8E7924716986E31BF52B3FCA9FB0B781638
                                                                                                                                                                                                SHA-256:987EB7DEB2211F6BCB391972114E1C5EE71799B5086F53F1125883F18DCF6CBF
                                                                                                                                                                                                SHA-512:F19535F91DE11CAB1AE3D6ACED695A372F23D96941A58BE0CB68F64C8AE901928158BCFC812F21A1F3D7E3CA1FE8892E24A4AD3F4F1A5AFABA6A0555B145E7CE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/network.vflset/network.js
                                                                                                                                                                                                Preview:(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof n&&n];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var p=ba(this);function r(a,b){if(b)a:{var c=p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&l(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,h){this.g=f;l(this,"description",{configurable:!0,writable:!0,value:h})}if(a)return a;c.prototype.toS

                                                                                                                                                                                                Chrome Cache Entry: 902

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (7566)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):38752
                                                                                                                                                                                                Entropy (8bit):6.109886396926918
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:VGnVCFqwivkN5LabUnoX2lVCFqwivk2JibRlU75mMhq:gniqaLeUoYiqGbomMk
                                                                                                                                                                                                MD5:F5629C31BCA5301AB5980247EFFEF360
                                                                                                                                                                                                SHA1:F61DB978AA8C26A7001DF3F7600515B9F07F5231
                                                                                                                                                                                                SHA-256:C852B1105EB000028E9B27677996F8D4773DAA31FA1AAF663CB6AE3A6857A50A
                                                                                                                                                                                                SHA-512:FC5C31A413C1A48664E3501725AF3B94965C44FD71D0763EE78D57ABA9216FF9D45A0AD279BB9695A25BDCAAD2AFEE7B627BB0FB83801EE85A2FC100B966CA02
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/eizi98w8jy0kml1jye1rlnpsw
                                                                                                                                                                                                Preview:!function(y,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((y=y||self).AppleID={})}(this,function(y){function t(a,b,c){return b in a?Object.defineProperty(a,b,{value:c,enumerable:!0,configurable:!0,writable:!0}):a[b]=c,a}var M,N=function(a,b){var c="string"==typeof a?document.getElementById(a):a;if(null!==c)return c.innerHTML=b,c},p=function(a,b){var c=2<arguments.length&&void 0!==arguments[2]?arguments[2]:"";("string"==.typeof b||"[object Array]"===Object.prototype.toString.call(b))&&(c=b,b={});c||(c="");var d="",f;for(f in b)void 0!==b[f]&&b.hasOwnProperty(f)&&(d+=" "+f+'\x3d"'+b[f]+'"');return"[object Array]"===Object.prototype.toString.call(c)&&(c=c.join("")),"\x3c"+a+d+"\x3e"+c+"\x3c/"+a+"\x3e"},q=function(a){var b="",c;for(c in a)a[c]&&a.hasOwnProperty(c)&&(b+=" "+c+": "+a[c]+";");return b},h=function(a){return"number"!=typeof a||isNaN(a)?"100%":Math.floor(a)+"px"},O=function(a){var b=a.color,c=a.bo

                                                                                                                                                                                                Chrome Cache Entry: 903

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 19 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):151
                                                                                                                                                                                                Entropy (8bit):5.9867401790628065
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:yionv//thPlm0tB4mf/lAsrtxBllvx/e9hKFqewzZan2GvkpZgeKzEmo25ZFsg1p:6v/lhPn74mf/lAsBi4EZ2dbo25ZWup
                                                                                                                                                                                                MD5:0667C2BF932C77B80EF533C5DC1BD7FF
                                                                                                                                                                                                SHA1:18015C76D9B6861D576841652E6963DAD26A3E35
                                                                                                                                                                                                SHA-256:4EBECFBB2C9CFF1741B805876370DB38D862A037F652D6F647CE51995E03DF2C
                                                                                                                                                                                                SHA-512:9C046E1341DB06415951AC06C8CB42E4DFF2BD445B922EA8D3E8994600E27DADAE6B7D54D93F9BC1E744187688C7D0BB3DEE55E14DD0B097340E53AC8CBF8CF5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/inputtools/images/tia.png
                                                                                                                                                                                                Preview:.PNG........IHDR...............:....sBIT....|.d....NIDAT(..1..0../....%.OkK.B.RH<..ac$..6.H.W...?...H.ZD.j.7..Z../...I*1...=.<\<.......IEND.B`.

                                                                                                                                                                                                Chrome Cache Entry: 904

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):11824
                                                                                                                                                                                                Entropy (8bit):4.306765430849705
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:F26SMbW4XFKQfjJ1yXczqPm55zYc3OQQiWp4L7w3DeMFWJov6dHmhr:F26SXyjfjusW+vYcUiWS+eMFWWvAur
                                                                                                                                                                                                MD5:FDC41C1E6C6AE5E5580F16DDBF54B8FF
                                                                                                                                                                                                SHA1:22AC53E9CD9C5B62127E26A67F00F0C20C656785
                                                                                                                                                                                                SHA-256:50F120F926C1520EC05A1C63CAB4B2C00FD7B1E8F94A3ECA839D7973A144F88B
                                                                                                                                                                                                SHA-512:885271FBD1B79E33B2FC91C2AF6A1285C42E08EC2276C942F784165B1389E66D5D56A66DBF99787234773B80370FA4F38F7085CADBF381C16FA54CC15E042BF4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_no_content/v1/192px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 195" xmlns:xlink="http://www.w3.org/1999/xlink">. <defs>. <path id="a" d="M0 194.555V.675h191.961v193.88z"></path>. <path d="M.668 18.586C8.545 12.047 15.125 3.19 25.082.49v20.673H.668v-2.577z" id="c"></path>. </defs>. <g fill="none" fill-rule="evenodd">. <path d="M63.227 57.833s-4.403 1.068-5.938 1.483c-1.456.393-4.553 1.79-4.443 6.532.112 4.74.112 4.463.223 5.85.11 1.389 1.11 3.444 3.053 3.999 1.944.555 2.834 1.777 2.444 6.386-.389 4.609 17.055-6.552 17.055-6.552l-5.41-15.82-6.984-1.878z" fill="#DDD"></path>. <g transform="translate(0 -.341)">. <mask id="b" fill="#fff">. <use xlink:href="#a"></use>. </mask>. <path d="M96.24.675c-17.36 0-24.86 17.956-38.835 24.25-9.382 4.226-31.732.669-39.879 14.75C9.38 53.757 20.86 65.52 15.12 74.544 9.38 83.568-.48 85.263.02 99.774c.5 14.51 20.374 19.494 22.32 30.4 1.946 10.908-4.853 13.059 0 28.997s18.193 17.626 35.867 18.065c17.673.439 14.368 12.34 32.52

                                                                                                                                                                                                Chrome Cache Entry: 905

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (663)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3238
                                                                                                                                                                                                Entropy (8bit):5.387809520815037
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:o7BOsUSmiHXpkgcKmdNQ8jsetptY2PfygpcaNQJpSN9KI9hGKb1iqyBKAErw:oE07udO2F5caNQJwN9KAuezw
                                                                                                                                                                                                MD5:6B5509EDF491407D765B9248417B3F68
                                                                                                                                                                                                SHA1:5380993E0C0CFA67982B78BD17E283625EE0E77A
                                                                                                                                                                                                SHA-256:F9D2DB8058E0E3CCBEA9FEA1551EE4D9ECFDBD010E10A9922B9389CCD2F13F31
                                                                                                                                                                                                SHA-512:EE9962EA56BE934771649D7157CD7D86933EF07C3813D5C5C962E2D3F5DC53D9F6502D9B2BE24B389E7CB48BF458E8A7E5962BC1FCF283381507724FFCC60989
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var $v=function(a){_.I.call(this,a.Ha)};_.B($v,_.I);$v.Oa=_.I.Oa;$v.Ba=_.I.Ba;$v.prototype.YM=function(a){return _.se(this,{Xa:{eO:_.Hj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.uh(function(e){window._wjdc=function(f){d(f);e(BDa(f,b,a))}}):BDa(c,b,a)})};var BDa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.eO.YM(c)};.$v.prototype.aa=function(a,b){var c=_.Xra(b).Xg;if(c.startsWith("$")){var d=_.em.get(a);_.Vp[b]&&(d||(d={},_.em.set(a,d)),d[c]=_.Vp[b],delete _.Vp[b],_.Wp--);if(d)if(a=d[c])b=_.re(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.Lq(_.jda,$v);._.l();._.k("SNUn3");._.ADa=new _.qk(_.vf);._.l();._.k("RMhBfe");.var CDa=function(a,b){a=_.rqa(a,b);return 0==a.length?null:a[0].tb},DDa=function(){return Object.values(_.So).reduce(function(a,b){return a+Object.keys(b).length},0)},EDa=function(){return Object.entries(_

                                                                                                                                                                                                Chrome Cache Entry: 906

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):20192
                                                                                                                                                                                                Entropy (8bit):7.966632534686911
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:TrHUXnc7/noz//Zt3MZb7KqtEhaj2sj7Myp7Fncp+v33VOeZxURn:qcbYZhMZnKQpj/jv5cw1Oqo
                                                                                                                                                                                                MD5:29F1E9F73A2226CC635061FC3C459FEA
                                                                                                                                                                                                SHA1:ACEC32FB870F1875D66F068A8C7448A4BF43526F
                                                                                                                                                                                                SHA-256:FA33772A253CA061106E7CF1602D6F839FAE9E15C1CB3A18B9898626E30CE8A8
                                                                                                                                                                                                SHA-512:98F2637DC09F310D2D642E31BDCFF76F9F620F27D651E4CAC83B607ED691DBE27C0675E0B4BE40F7BDD736AA4321066C58AE9D9379886F15C61595D9C7E52F50
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/423532108_3376307412667808_8091808659321521448_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=URwafMLgwnYAX9jMT9G&_nc_ht=scontent-lga3-2.xx&oh=00_AfD4HnrzKeKAI6QpTeOQNgAzktAFvAzZ43Dzbeof1XzAYw&oe=65D328F7
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000cc06000012110000311200006c13000029220000f23100000433000077340000eb350000e04e0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................H...|.....I.....3.8Ayqgty..{^...G...PbJ..~..O:.V.......5T...-.:P...>..V.<{Eh....bR(...zE......c.(.|q.k.....5q.:...F....k.....`......4...Zw&..U.Jd...69...y...[.u,.e.t..jz.....,*......?~R.3={npZ~i..0.....aJ..H..N.=..,.7N.G.{.z;.9..l......'.*....b+#xm.#..0g56...&....|....y0....l..;t...P.C5.R..g....5..U_....c.:....O......=f9.U........T.OD..M......uz..K..&n.....>..\.~..u.....M...Mc@.yWZ.....>..Q..Q...|......lX.re.l&.&..z....._@\..1aa[.$0...o...}.....9[..V..@G>1...,.!...p....sR..Z.@Z.+........t..ak-.lV@.0u.+(:...p3 O.i5v........../P[..JX....\4..Z4..@...-...D.Z$...pD.L0.b....c..

                                                                                                                                                                                                Chrome Cache Entry: 907

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (50834)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):52047
                                                                                                                                                                                                Entropy (8bit):5.676533041822284
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:jw5r54rLGJcu6FimSaWSuN72y05Yu8/nUKeMIJ3o0Hja+992Cg8gNVY8a25XFL2U:jUN0FeaWpu8vG7Da+j2VVYzEXFLQg
                                                                                                                                                                                                MD5:6B742A0E049C73773304CE985EF94CE0
                                                                                                                                                                                                SHA1:AF78A543B7BC6C9BB7DE6F0664136C03FDDC7A0F
                                                                                                                                                                                                SHA-256:84E48BDF0CE16674564197E5AE45172E92AD0B3E63A616A0352F3D99B7C94447
                                                                                                                                                                                                SHA-512:45234E5D3317B578D8228E68EB3FF013EBDD185D3CA762D8B506E66BAF2DF1472C21723AE182FCDFF31353D29E33E625AD83789CFABE8E2E0B5941993242E4D3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.google.com/js/th/hOSL3wzhZnRWQZflrkUXLpKtCz5jphagNS89mbfJREc.js
                                                                                                                                                                                                Preview://# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==.(function(){function r(p){return p}var u=function(p){return r.call(this,p)},k=this||self,d=function(p,U,W,X,e,v,c,f,Q,K,m,I){for(K=(I=80,58);;)try{if(I==U)break;else if(I==W)I=Q&&Q.createPolicy?25:40;else if(86==I)K=58,I=66;else if(80==I)Q=k.trustedTypes,f=c,I=W;else if(25==I)K=W,f=Q.createPolicy(v,{createHTML:u,createScript:u,createScriptURL:u}),I=p;else if(66==I)I=k.console?X:p;else if(I==X)k.console[e](m.message),I=p;else{if(I==p)return K=58,f;if(40==I)return f}}catch(O){if(58==K)throw O;K==W&&(m=O,I=86)}};(0,eval)(function(p,U){return(U=d(70,62,39,88,"error","ad",null))&&1===p.eval(U.createScript("1"))?function(W){return U.createScript(W)}:function(W){return""+W}}(k)(Array(7824*Math.random()|0).join("\n")+['//# sourceMappingURL=data:applicat

                                                                                                                                                                                                Chrome Cache Entry: 908

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):8816
                                                                                                                                                                                                Entropy (8bit):5.436678491959421
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:ylNOClN1lNzlN33nlNLlNjAlNOkNfCkNRkN+kN23nkN6kN+AkNIPNKCPNBPNXPNH:yLOCL1LzLnnLLLsLOifCiRi+iEni6i5d
                                                                                                                                                                                                MD5:AE497D5B41E511A0C483D361F08C36A4
                                                                                                                                                                                                SHA1:0ECCD2799595112C5B8169CC3370A2F0E384C028
                                                                                                                                                                                                SHA-256:C05133DA71148E748CBFB62FBE60097B7FF257B76B0369CAFBB7F0C1C5C2F13B
                                                                                                                                                                                                SHA-512:7316310406CAC1A179E3DE13AFFBA49FBE9B0B1A217A71AB1B6D7AB6287909E80010D4221209E526D939309C0CD21D7DDE7A1FF4E84D4ED146EE005FA0F672D5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://fonts.googleapis.com/css?family=Roboto:300italic,400italic,500italic,700italic"
                                                                                                                                                                                                Preview:/* cyrillic-ext */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc3CsTKlA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc-CsTKlA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc2CsTKlA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc5CsTKlA.woff2) format('woff2');.

                                                                                                                                                                                                Chrome Cache Entry: 909

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (19300)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):278240
                                                                                                                                                                                                Entropy (8bit):5.408908945489909
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:fPHaQFjDxlJ/yfJJubY9OD47Yzz4HEBuP2IUeOkFCbPIO6I3uclVuYgyi3i8/Kin:BYxm7wP2IqnKxmIgcSDOOa
                                                                                                                                                                                                MD5:176E6724E564A38784790EE1B4429847
                                                                                                                                                                                                SHA1:436956E9333E4A2DC0D8A2FC3A05D241F0AD81F0
                                                                                                                                                                                                SHA-256:597A1ADC0092827558E460D5E43C73AB9CC6ABC3405242B8A0E25E8B1BA61E2F
                                                                                                                                                                                                SHA-512:FDC3A0F51ED750CCA21C3D34C279FE4C0E3C20EDBF4AAFA2732ECE58F717D142BEC024CF22BCD334F3088DFA5C0A9C5D0F182C56F7B0D672082BD01D00DD8A9B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/y7/r/cxpSJT4FJoH.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis||typeof self!=="undefined"&&self||typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)||d.set(e,new Map());var f=d.get(e);f.has(b)||f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

                                                                                                                                                                                                Chrome Cache Entry: 910

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1143)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):4272
                                                                                                                                                                                                Entropy (8bit):5.407649241930215
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:bVcC0LhyRs71268NYZOAx/rfuNfnAZe5PwGNHW:B3qhpRByNPx54GN2
                                                                                                                                                                                                MD5:B427175FA1078775EB792756E7B6D1E7
                                                                                                                                                                                                SHA1:4C55C0233D3D9002B3449C025F97821F8BB8900D
                                                                                                                                                                                                SHA-256:EE147E859AD0F09AA50367974E38AB53E7C7054C4A51D400A7F45B0EB251454F
                                                                                                                                                                                                SHA-512:AF8D384188363378BC99C2E51523E74E1D18BA77D51BFF7647A377A117499421F9E94477E09907925E46DAD0A908B799A616D0B4855FFFF064BA6350815063D3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
                                                                                                                                                                                                Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.'use strict';var l=function(){var a=h,b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},m=this||self,n=/^[\w+/_-]+[=]{0,2}$/,p=null,q=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce||a.getAttribute("nonce"))&&n.test(a)?a:""},r=function(a,b){function e(){}e.prototype=b.prototype;a.i=b.prototype;a.prototype=new e;a.prototype.constructor=a;a.h=function(c,g,k){for(var f=Array(arguments.length-2),d=2;d<arguments.length;d++)f[d-2]=arguments[d];.return b.prototype[g].apply(c,f)}},t=function(a){return a};function u(a){if(Error.captureStackTrace)Error.captureStackTrace(this,u);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}r(u,Error);u.prototype.name="CustomError";var v=function(a,b){a=a.split("%s");for(var e="",c=a.length-1,g=0;g<c;g++)e+=a[g]+(g<b.length?b[g]:"%s");u.call(this,e+a[c])};r(v,u);v.prototype.name="Asse

                                                                                                                                                                                                Chrome Cache Entry: 911

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 21700, version 1.0
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):21700
                                                                                                                                                                                                Entropy (8bit):7.989666631701204
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:PxbG/ZciREUTWlMwbptJm5f9/1HuLZ4r38bxSpfGL/+SHA+ilQlO3fq8O/4s:5bfiBWlRPm5fjrruYJGTiqlO3fo/p
                                                                                                                                                                                                MD5:7D75A9EB3B38B5DD04B8A7CE4F1B87CC
                                                                                                                                                                                                SHA1:68F598C84936C9720C5FFD6685294F5C94000DFF
                                                                                                                                                                                                SHA-256:6C24799E77B963B00401713A1DBD9CBA3A00249B9363E2C194D01B13B8CDB3D7
                                                                                                                                                                                                SHA-512:CF0488C34A1AF36B1BB854DEA2DECFC8394F47831B1670CAB3EED8291B61188484CC8AB0A726A524ECDD20B71D291BCCCBC2CE999FD91662ACA63D2D22ED0D9F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
                                                                                                                                                                                                Preview:wOF2......T...........T_..........................4..*....`..~..d..u.....,..$.....6.$..|. ..V..K..^.=...sp.f.m../....l\.....T.9.n..A...........2x.{P[V..v%..M...f.7..+c.cM.'...$..u.H4[?i.'..T..+.(...L...inV.@.dd....T.. }b...c.ghRA..I$.su.....`....Q.OB..S.{.#.3..o.{v.........n...]f#b.J_.......}# ..1... F........=?O.|._p........X.6.VQ.*.E..rU...}....dK.$...0.W..2i..Y...9.Y.............f{..6'....C:%.(........}.....W..._....k...|.........Y8./..e..........L......_.9..v...2F..$..y)....UWu_..T.]qE.H.b..OP...B@.4.!,F..._............z.3.*.A,h.M.(...6~_[U$.....uM2.*..qz.v.........hV\|?.......M-.h..by.A,.}.....?...52.g.,....<..s..k....h.U.]1.1..O......m......j...}6.j.v.a..R....Fj...).fO3........GSM....... ...GL..({A....$O..&'..\....:.x....{N.p8..q..iF..k...b.>....<..M..`.....d.I.5... .x...mo.L.?A(..F }./.._V.e.A.Z3.....C...h...f......(,..3....%.h'.?sG..&x..W.......b].'34.S#s...wiG.O....J.ADDDDBw.m;.....K.ti).....?.6.\.M..d.....[.z....4..D.b...6..F.....F..D.r

                                                                                                                                                                                                Chrome Cache Entry: 912

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):372
                                                                                                                                                                                                Entropy (8bit):4.852483300837517
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohgqWHiA4vmI4lAwuQgQIVY6Wqx5Xt6M0TRcmQTIfyuETUrNmraXnPZ:t4noOAvmRHnIq6JmM0T7QobETUrsOpka
                                                                                                                                                                                                MD5:388308EEFFE6F910D8A30CA28F6A4306
                                                                                                                                                                                                SHA1:864144A8145338E37C1DEF12177A02EECBABA4A2
                                                                                                                                                                                                SHA-256:A78851FF5ED5AB0CB2DE879F608214C4C33BC41841F279B1F622835407AEA643
                                                                                                                                                                                                SHA-512:460C26A65AB98BAD2574A5A3405CBFEC71465544632887C388E982E84EBEC2E45F21D703767783199186C51A2998965EAB3A66F5ECD4753E26D6B257ECDAD0DD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/fashion/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66zM14 18H7v-5h7v5zm1-3v-2h2v2h-2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 913

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):651
                                                                                                                                                                                                Entropy (8bit):4.46155201399217
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmnqMViiuJJsUG0aLn+djONWQismTRIaZmU5SuX6RfM3FLvTkwWEarekr:t4jU/vns0aLn+djqWQismiaZ5SuKNMFo
                                                                                                                                                                                                MD5:C34B523D2E0170B739016B744ECD8132
                                                                                                                                                                                                SHA1:F7CA671F70271C053516306DF1820618C279E657
                                                                                                                                                                                                SHA-256:55C9BBA2243E3B97567B36A6F9C888A52805E5B6C391168C892D5D024BC01266
                                                                                                                                                                                                SHA-512:01AE29522C00F9761ECE2399306313A85BB5E65797011BAFFC40BBA54540B718F423F5707A67EB16B43B78EFFE1D40906B4E422D1AF7FCE8BBC0C32A8F9BAF46
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-2-2 .9-2 2-2 2 .9 2 2zM8.48 8.45l-.71-.7C6.68 8.83 6 10.34 6 12s.68 3.17 1.77 4.25l.71-.71C7.57 14.64 7 13.39 7 12s.57-2.64 1.48-3.55zm7.75-.7-.71.71c.91.9 1.48 2.15 1.48 3.54s-.57 2.64-1.48 3.55l.71.71C17.32 15.17 18 13.66 18 12s-.68-3.17-1.77-4.25zM5.65 5.63l-.7-.71C3.13 6.73 2 9.24 2 12s1.13 5.27 2.95 7.08l.71-.71C4.02 16.74 3 14.49 3 12s1.02-4.74 2.65-6.37zm13.4-.71-.71.71C19.98 7.26 21 9.51 21 12s-1.02 4.74-2.65 6.37l.71.71C20.87 17.27 22 14.76 22 12s-1.13-5.27-2.95-7.08z"/></g></svg>

                                                                                                                                                                                                Chrome Cache Entry: 914

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (511)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2051
                                                                                                                                                                                                Entropy (8bit):5.245569770149611
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:x2npr4QxmTJsIxHPTNSxf0gzu590yKECxex3XZKE+:x44wmTJsYH7NGf0gKT0yKE2K3pJ+
                                                                                                                                                                                                MD5:A94E7CD86F5824E27720F5D3C712DF9A
                                                                                                                                                                                                SHA1:7BF52949685727D7133F452B432A57615E40978F
                                                                                                                                                                                                SHA-256:59CE6BDF8E3D17BB68667499C34A3EC32B9F7836DBCA59D03237A4C9FFFEFD35
                                                                                                                                                                                                SHA-512:726D7BB3C7D356453A10D590EE4806BDE864FC7E909BA8F03E194B1F1BAA0D65AE8FC89E9E393F2300ED3536969E7445AC39860E3BB0EA338EF19F4B51139B9F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js
                                                                                                                                                                                                Preview:'use strict';/*.. Copyright (c) 2016 The Polymer Project Authors. All rights reserved.. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt. The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt. The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt. Code distributed by Google as part of the polymer project is also. subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt.*/.(()=>{if(window.customElements){var h=window.HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=h.prototype;window.HTMLElement.es5Shimmed=!0;Object.defineProperty(window,"customElements",{value:window.customElements,configurable:!0,writable:!0});Object.defineProperty(window.

                                                                                                                                                                                                Chrome Cache Entry: 915

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):6167
                                                                                                                                                                                                Entropy (8bit):4.4514990753759855
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:3ZCiNo0UQX1uXwGtjvjvDd3ti/F/0nP7/vEcKhirGGb7m/8sDM4UF9YX:Ai6nQX1uXZjvjLzGF8Pzv4E71EM4UP6
                                                                                                                                                                                                MD5:81DFE7BB0CBBBC7468DDE13D3F649273
                                                                                                                                                                                                SHA1:457BDF6F22B4C51255FBB5F198CA610B1037A932
                                                                                                                                                                                                SHA-256:3B1F3E116BB9E9FBDD0D1643D703CAA562E235EBC0B814214A83C23B8CC271D6
                                                                                                                                                                                                SHA-512:5BC6D25943EAE352363ED0123B9B178790AE2834A25178DA68603DC60E98FA531EA5148A2D93403A09829E0B387BC7E80A53CF8151CCB372A1386A1857F5F118
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/open.mp3:2f700953253421:0
                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom.......gmoov...lmvhd.............D..8.................................................@...................................trak...\tkhd....................8.................................................@...............mdia... mdhd.............D..8.U......"hdlr........soun.................?minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................Lstsz...................................i...................z...w...m...M....stco................udta....meta......."hdlr........mdirappl.............rilst...!.nam....data........speak_now....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000151 0000000000002E6F 00000000 00000000 00000000 0000

                                                                                                                                                                                                Chrome Cache Entry: 916

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (537)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):120225
                                                                                                                                                                                                Entropy (8bit):5.488640897900843
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:il2OQARzpdKV4zqPPL8B4HkwmAZfHiBJPuKeCM0hdiK:q2OQA1pdKVGqb8B4HkwmAZfHiBJPuKek
                                                                                                                                                                                                MD5:3F55585BE7F5A50662D88DD7DA7A7E26
                                                                                                                                                                                                SHA1:C6920CCFC829D4E7F3E0F5B151A5EE69228200D9
                                                                                                                                                                                                SHA-256:B40C94F7D6D8CADA4666C5D047768D0C4899E81405A9F4F03061FC5FC612B1BD
                                                                                                                                                                                                SHA-512:D0123EA57BE17FE9D209CF1B8AC65CCB4523D237B3897BE48F0739F3BF1C8B5FAFE9D07BC9F7CE88E3A87C752A02EF8106E4F952FB9F170BD38079756D47D96E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/remote.js
                                                                                                                                                                                                Preview:(function(g){var window=this;'use strict';var a8=function(a){g.Ho(a,"zx",Math.floor(2147483648*Math.random()).toString(36)+Math.abs(Math.floor(2147483648*Math.random())^g.ob()).toString(36));return a},b8=function(a,b,c){Array.isArray(c)||(c=[String(c)]);.g.Iga(a.B,b,c)},Uyb=function(a){if(a instanceof g.jt)return a;.if("function"==typeof a.Jk)return a.Jk(!1);if(g.bb(a)){var b=0,c=new g.jt;c.next=function(){for(;;){if(b>=a.length)return g.K2;if(b in a)return g.kt(a[b++]);b++}};.return c}throw Error("Not implemented");},Vyb=function(a,b,c){if(g.bb(a))g.bc(a,b,c);.else for(a=Uyb(a);;){var d=a.next();if(d.done)break;b.call(c,d.value,void 0,a)}},Wyb=function(a,b){var c=[];.Vyb(b,function(d){try{var e=g.Cv.prototype.B.call(this,d,!0)}catch(f){if("Storage: Invalid value was encountered"==f)return;throw f;}void 0===e?c.push(d):g.yla(e)&&c.push(d)},a);.return c},Xyb=function(a,b){Wyb(a,b).forEach(function(c){g.Cv.prototype.remove.call(this,c)},a)},Yyb=function(a){if(a.ma){if(a.ma.locationOverri

                                                                                                                                                                                                Chrome Cache Entry: 917

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):474
                                                                                                                                                                                                Entropy (8bit):4.7449073607550805
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRGLHuojuMUMU2lX9KuMUMU2lZzrvCJig/I3n8:t4jU/vjtuM5JlX9KuM5JlZ/qwX38
                                                                                                                                                                                                MD5:CF92CBEE09BC23E2B2EAE3EF6A9DFF40
                                                                                                                                                                                                SHA1:E9EEB3AE2294064FD7B0A5026B5AE02A6564C9AD
                                                                                                                                                                                                SHA-256:60FC606F480F263CDC9CF180089D42E4A070395B47D0331E7C869A9F6FD2208A
                                                                                                                                                                                                SHA-512:EF4944E4E9FE78DD00D379EE192FEF915BC3AA45E6029AC21CA858C5C8D65EBDFA70F78CF87F00A623D311CC3ABF453CFD5DFFEC442F1A87EAE23E548DF92295
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/gaming/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 12H8v2H6v-2H4v-2h2V8h2v2h2v2zm7 .5c0-.83-.67-1.5-1.5-1.5s-1.5.67-1.5 1.5.67 1.5 1.5 1.5 1.5-.67 1.5-1.5zm3-3c0-.83-.67-1.5-1.5-1.5S17 8.67 17 9.5s.67 1.5 1.5 1.5 1.5-.67 1.5-1.5zm-3.03-4.35-4.5 2.53-.49.27-.49-.27-4.5-2.53L3 7.39v6.43l8.98 5.04 8.98-5.04V7.39l-3.99-2.24m0-1.15 4.99 2.8v7.6L11.98 20 2 14.4V6.8L6.99 4l4.99 2.8L16.97 4z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 918

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):19413
                                                                                                                                                                                                Entropy (8bit):7.9618399854891955
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:384:XRDGrH0qWpFVlQUEPpxjgH/N3opTH7iZvXPcVf8GyggzG/pjy/aRV28I:XRNqcV+3pVgVGHOt0Op6pjTI
                                                                                                                                                                                                MD5:06EC94367DDDD3C25022297E7B8ABD29
                                                                                                                                                                                                SHA1:6788E232A14264038A80A25CDDE5EA68AE59A5DF
                                                                                                                                                                                                SHA-256:5F31CE5D8B4EF09C61C8ED89E2ED30D65B0BD53636145E6480DD88D3EDDF0D0A
                                                                                                                                                                                                SHA-512:329B1CF6BCC58DB1A0FAD33593869283064A4ADBF0F706050F28184BAC50BAEB22B9F77C5F6D18C25F788D2B43585F193C8CBA32D5BADF583117958841473ADA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t51.29350-10/427424919_1171201727179312_305728371073625633_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=cdC0GX4jN_kAX-dmKpY&_nc_ht=scontent-lga3-2.xx&oh=00_AfDnKkxxqdAD_rO7TKWI4NZRq2u-wldHKJZugqX5G_zshQ&oe=65D3C876
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100008e0600002d100000b41100002a1300002c1f0000ac2e0000bd2f000049310000e8320000d54b0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................{......{..=.......P..5.tO.T......b..l........ .......p9.@;.......b8..iR.o.. ...O...@..xN.K.2..~............\.....xT(.L...w......'...;Y..3b.../Yo....k....E..f.t..>}|\.RR........xz^.X......y9..C...H.....d.K.j.I.WD..u.Vu..i_JM9tv9..z'0A..p.....b.p.b.X.x..n,....{9.._.....f&......."pL......7..:.f........A.2.7..1..t. 5..L.....H...k..<J_s..u.......y/....!C.....=.Na.b.....v..*...{..S.-.4Y.D........b$|..`*......,.n...4....S..HvU..._.T.Y.IN.:.S....7....p;z..pz^.1..h.0.@U.1h.m...W.W:.HD...\...... .C........Nz.....T+8...aJ!>.o1.j.....Nj.N.5....gCr..&.z....&.i+14.T..Z."..Y.z....

                                                                                                                                                                                                Chrome Cache Entry: 919

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):211
                                                                                                                                                                                                Entropy (8bit):5.119467255389257
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI42IBIAFzKVN/YWAIQfgZi:t47N9U/vmR2I+jVyIKg8
                                                                                                                                                                                                MD5:914B3584E764344B898D1431747A8A4C
                                                                                                                                                                                                SHA1:C870050A1AEB28C22867785E93A304794375FCD2
                                                                                                                                                                                                SHA-256:B9E9D5F5F7AF96C4272B4ECE21F8B568F8B03D70D6ABA3DEBA5F823E81796F15
                                                                                                                                                                                                SHA-512:A8040E77D002823D9D190822C23A4619052CAB4DB0E18658ED62DD50254E96ECB47A7D0F776977F404D60DF839AFD447A5061B564CC8DBA4A0F6A1B47BA5D2AA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/trash_can/v5/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M11 17H9V8h2v9zm4-9h-2v9h2V8zm4-4v1h-1v16H6V5H5V4h4V3h6v1h4zm-2 1H7v15h10V5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 921

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):35189
                                                                                                                                                                                                Entropy (8bit):7.938561164499153
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:zPP4dTBD6rd7obwBCkbJAsvoWGpjEVsAkCVEK:WND6rd7obDktT5sAkCn
                                                                                                                                                                                                MD5:9A938CE7FBDB91267F552908BC37FCB1
                                                                                                                                                                                                SHA1:EDFF55730F58490AC34E1B3CFE3A0FC8F76E4F94
                                                                                                                                                                                                SHA-256:3781BB4D6E9CE020088C5526F0858B0DCE5F5E848678714BC0CF0346DF1E9AF1
                                                                                                                                                                                                SHA-512:E0851E58E77719BCA75F46D96633D4D0BFED292A0DB88641EA54023631E909A7CB4B5634CD176780F669DACB3244C9D4F9953DCECE0495F94B87536D11E99F12
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426380116_355184234104450_904582644126882808_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=rOpGaEmyKiYAX9nI1t8&_nc_ht=scontent-lga3-2.xx&oh=00_AfAzNdkqNZwE7P2N9Rx4a-KTFKu7BgLzf3LTasKrIt8AWw&oe=65D3FE78
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000701400008d280000f12a00001a2f0000563a0000a0510000ed5700003e5b0000f860000075890000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................H.....................................................................................................................................................................................................................................,YZ.V.V.............c.c.c.c.c.c.e....0f......................c.J.1L...L.l..D"Q.PR`.D...P@......BYBD......2..r).H....a=..T$De.........$BD$Bb........P......@P...eh..!"...d.,..2.......P@P..H.BD&.....((".^:b.!(....."b!8.....h K.D%P..........@P.... .P.........L.BQ.D...A`(@..( ..........@"Q...... *..L@(.."2....@....(......(............*..$.."$@.,..%...J @PJ.,%P ........h......G\Bb.1."`

                                                                                                                                                                                                Chrome Cache Entry: 922

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (3537)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):52603
                                                                                                                                                                                                Entropy (8bit):5.316331138717284
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:yYrF+dXpn0e+99D7FPUzHhbtjFnmFRbdwWRI32nB7PXAlnuhPisfq3ECoe5EzpGS:yYrF+d5n0e+99DJPUzHhbtjFnmFRbdwM
                                                                                                                                                                                                MD5:F0A9F2F65F95B61810777606051EE17D
                                                                                                                                                                                                SHA1:872BF131CB4BEFD0242339F072F2F9B9FBF8019F
                                                                                                                                                                                                SHA-256:9CDF2602AC04F7E2BED582D4299C73D464FC4AB069E3AD5A20EE2B6635A015B8
                                                                                                                                                                                                SHA-512:6823914507BA31E0F61B95CC53F09543C3C14E5530E9EF1B00338FBBD7C25D2E398F5F628DF4ED25D6FF88E0F8BEE506EFE62BA704778BA7CFF09AEC9579D9F0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/eureka/clank/117/cast_sender.js
                                                                                                                                                                                                Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.'use strict';var f,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},h="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&h(c,a,{configurable:!0,writable:!0,value:b})}};.da("Symbol",function(a){if(a)return a;var b=function(g,k){this.g=g;h(this,"description",{configurable:!0,writable:!0,value:k})};b.prototype.toStri

                                                                                                                                                                                                Chrome Cache Entry: 923

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:XML 1.0 document, ASCII text, with very long lines (540), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):540
                                                                                                                                                                                                Entropy (8bit):5.0953958403229755
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:TMHd2yqNZNNUrS7n4nuL0EGuSl6FGYdB2GSuh43JPYa0:2d2PNdUrS7nfcuSQ8YdqXya0
                                                                                                                                                                                                MD5:AABAC4B67E56DCAAA0C06DCEA2C8C7EC
                                                                                                                                                                                                SHA1:4AEC6ABB0BCB8B6828F0CFE62637D3B270FDEA6C
                                                                                                                                                                                                SHA-256:96D0C3380F81C5C429B2FAB04F6A9961F83287D1922A1B44A1DBD4A4004D62B6
                                                                                                                                                                                                SHA-512:C9709D6C0A2EE21148E5D8826A3093E3A353B7D2BA0C135924EA8079982A8475F71B5926AFE6F21FF67C2538574D2F6EC0C20C97ED836F6A67799EA05D20AC6D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/opensearch?locale=en_US
                                                                                                                                                                                                Preview:<?xml version="1.0" encoding="UTF-8"?><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/"><ShortName>YouTube</ShortName><Description>Search for videos on YouTube</Description><Tags>youtube video</Tags><Image height="16" width="16" type="image/vnd.microsoft.icon">https://www.youtube.com/favicon.ico</Image><Url type="text/html" template="https://www.youtube.com/results?search_query={searchTerms}&amp;page={startPage?}&amp;utm_source=opensearch"></Url><Query role="example" searchTerms="cat"></Query></OpenSearchDescription>

                                                                                                                                                                                                Chrome Cache Entry: 924

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (612)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5996
                                                                                                                                                                                                Entropy (8bit):5.333832123538773
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:3b+xu6Xvi9MjDJH4b00/Ehufm1sZSurumwgk2CzuIHYfVEAxzjtMK9NATIub:32fKzdugSLLF+tRQ
                                                                                                                                                                                                MD5:EC72A757ABBA28CB1DDDCDE8928BF192
                                                                                                                                                                                                SHA1:D2C8B9B60BBCF074386A139075E5D087FF07CCCB
                                                                                                                                                                                                SHA-256:C8F987C5B2238BBDCE06D97560CCC5E9069EE4766DF9C95C084708BD002E6999
                                                                                                                                                                                                SHA-512:2A7BC3B9817DAFEF2F2127AD13FEFCEDBFB4697D21B5089C74E481DC63342DB73C69054A033F9D98F6374D9BF976E65F4AB799FC8E6C134C7B85AAEC3D098262
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/miniplayer.js
                                                                                                                                                                                                Preview:(function(g){var window=this;'use strict';var Zsb=function(a,b){g.V.call(this,{I:"button",La:["ytp-miniplayer-expand-watch-page-button","ytp-button","ytp-miniplayer-button-top-left"],Y:{title:"{{title}}","data-tooltip-target-id":"ytp-miniplayer-expand-watch-page-button","aria-keyshortcuts":"i","data-title-no-tooltip":"{{data-title-no-tooltip}}"},V:[{I:"svg",Y:{height:"24px",version:"1.1",viewBox:"0 0 24 24",width:"24px"},V:[{I:"g",Y:{fill:"none","fill-rule":"evenodd",stroke:"none","stroke-width":"1"},V:[{I:"g",Y:{transform:"translate(12.000000, 12.000000) scale(-1, 1) translate(-12.000000, -12.000000) "},.V:[{I:"path",Y:{d:"M19,19 L5,19 L5,5 L12,5 L12,3 L5,3 C3.89,3 3,3.9 3,5 L3,19 C3,20.1 3.89,21 5,21 L19,21 C20.1,21 21,20.1 21,19 L21,12 L19,12 L19,19 Z M14,3 L14,5 L17.59,5 L7.76,14.83 L9.17,16.24 L19,6.41 L19,10 L21,10 L21,3 L14,3 Z",fill:"#fff","fill-rule":"nonzero"}}]}]}]}]});this.J=a;this.Ta("click",this.onClick,this);this.updateValue("title",g.rU(a,"Expand","i"));this.update({"da

                                                                                                                                                                                                Chrome Cache Entry: 925

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (8178)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):66734
                                                                                                                                                                                                Entropy (8bit):5.520875566204415
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:qgd6FE6U5v/FSisNk3a+awDbDib1/W9x4oVhmb5xiiC3:xF21/W9xA7ir3
                                                                                                                                                                                                MD5:2A58FF9F198E0A6D83A739C49C775DF7
                                                                                                                                                                                                SHA1:E25C55ADD1201123858C2CCEE8DFDEB59F658A29
                                                                                                                                                                                                SHA-256:8312D9363D6BB007DB6712DE6C8BE0F6D23DD761619001059CCF817402DD64C4
                                                                                                                                                                                                SHA-512:B83C3D1DA32667268866525BF7EC28AB0F31C64F4684ACBA48A02FDCA76B1F6033172BABE7B812FA485BFD4BF6B8EB81E71EA2B49847829F0D46CF6B80B65FD0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3itSY4/ym/l/en_US/mBLEwO2HfDCHu1lo-vtGQXzRuX-xC3XBj86d5bsesCfsToQIrGjpnSUxsw_y3zVOBSb43UBAu_ho_d8w70Ttksmt5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometTextWithEntitiesRelay_entity.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a={alias:null,args:null,concreteType:"WorkForeignEntityInfo",kind:"LinkedField",name:"work_foreign_entity_info",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"type",storageKey:null}],storageKey:null},b={kind:"Variable",name:"scale",variableName:"scale"},c={alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},d={alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},e={alias:null,args:null,kind:"ScalarField",name:"width",storageKey:null},f={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null};return{argumentDefinitions:[{kind:"RootArgument",name:"scale"}],kind:"Fragment",metadata:{mask:!1},name:"CometTextWithEntitiesRelay_entity",selections:[{alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},{alias:null,args:[{kind:"Literal",name:"site",value:"comet"}],kind:"ScalarField",na

                                                                                                                                                                                                Chrome Cache Entry: 926

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):252
                                                                                                                                                                                                Entropy (8bit):4.749518607468393
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slmKkmPUtlXX5xiUSdztsG4J5GXyAajYUNrLVKLbrwPtOTC:t4IrmPoXXmUSBaYaj/rL8LvE
                                                                                                                                                                                                MD5:F8F3636F756E2E0E0892FD9E35174490
                                                                                                                                                                                                SHA1:6C735659FF64B530A9DA358FEFBF75CB6B14B300
                                                                                                                                                                                                SHA-256:2634B0DB38CF06C1261C115FD4B5D56177988D8F4E0CD2597A23EF7A44A94D37
                                                                                                                                                                                                SHA-512:47834E3B35CE2C0B1315E637F81AD7996E738C429AFA4E9FBFAC2BD08C26097381F3353F746923FEA16B045117AC4C615726203063CFB8654E7D4C19A273BB52
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-up/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5 6.71v2.06c4.01-.91 7-4.49 7-8.77s-2.99-7.86-7-8.77z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 927

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):48462
                                                                                                                                                                                                Entropy (8bit):7.996505285466222
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:768:fbYqyoAEwfPs/iHidTpR5sdPzdHPgYlSPcCjEndF6toYQdi+TV+Zx+F6pzzWyQzl:zYqyovUs/4idTpszHPTacCAndF66di+1
                                                                                                                                                                                                MD5:DA10D5DDCE31F7CEED2056618CE39D6A
                                                                                                                                                                                                SHA1:AA011925329825E6FEDB8AF7A4682F59ECC915D8
                                                                                                                                                                                                SHA-256:7596230146C37964C8317B141E91F183307DFE3685B47B43AC7B2323458EC4F9
                                                                                                                                                                                                SHA-512:8525FE258E1BB514DBA642EA4A00377676CDCE572B8FD240095AA1E5EA969F86F5F598CC6E46D01853401525ADE0EADD50A96DED114181D98686028D329FCB8E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/qqrpMRDuPfc/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBg94vcph-pJ5UrvrnNHiZlFI-xTQ
                                                                                                                                                                                                Preview:RIFFF...WEBPVP8 :....o...*....>Q$.E#.!'...X...em3.k;~..y...g.=.q.?..[....(....U..F.....?.;........?T_...x.....`..?..G......s.......~......./.?.....r-.~..9.......)........\......z.~...............~.?....W.u...3.s.s..+...o...._...}......Q.../.>m>.._.G.._..............S.3.......}......../..?..h.......n...../..n...7.../.........W.O...=......y.............~s...w.............s...._...}.........G................o._k_.>.....L(.4..d.M........E6g.01...v.D.q..)[y-...........l.....!.jS...X.|b.F*.-VlD.....X.$w..).).G.kX.....W|.s.g.X.d.0..70.f..L.P.>....N9.6.M.ML.._..t9p../...&..J.5.W&J_Ci......|jAf]....3.AQ6....~....(2%..O."..~.(4...q).&i...M*..A.goS........,!.......Y.o...f.y...PY..v...)..Y..bZ...m^.,\......v]=v...r.Dk...9.U9.3s..X.y.T......%...{(.0.s......y.........SQ..K.5R...X..Q.O.$:.9).,_.2a...c..x..5[...F.. ...+e..9..7.....<.O{..".5..}..{.Y.....x.."...........M.9[AA.D...,....lI..6)}"....oin&..5......e...u.gH.=On/..k.A1.........i...............

                                                                                                                                                                                                Chrome Cache Entry: 928

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 192 x 192, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2106
                                                                                                                                                                                                Entropy (8bit):7.554456957317547
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:EWP8JUaPVKWwCtcHB3sXXRBJ3v8qkZ/aWr/3KZerMLvSOxJ3Df8sfqV1:lkJVKWw03XXZ4Meo931fq
                                                                                                                                                                                                MD5:6452ED75C53E1A8E90A664DF18959A90
                                                                                                                                                                                                SHA1:AC01FC2F40F0E4808E22A9C569F3775F0F15A5E2
                                                                                                                                                                                                SHA-256:C7BAC3E7016DFC7EB5787579BAC6B975B433FC1A9C279DAFC35649D4782F2061
                                                                                                                                                                                                SHA-512:4B23F7FB31826943CBA6496BD74DC620C8EC3B8F0525497E825F1F1F87486335D4374F85417458C3C3E018C2215B9B419D7DE77CB67AAE9EA619038432E1EB10
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/eFZD1KABzRA.png
                                                                                                                                                                                                Preview:.PNG........IHDR.............e..5...YPLTEGpL.e..e..e..p..e..f..f..h..f..f..`..`.....g..f..f..g..g..f..f..f..g..f..h..e..f..d..g..e..e..c..f..f..e..f..g..g..e..f..f........i..h..e..f..f.....e........e..g..f..f..f..f..f..f..g........f..e..e.......F........................f....F.....d........'y.....p....E.....U..7..t.................6..t...........U.................................p......uy...LtRNS.0`..... ......p..._....@..@..oPP...O.^..__....0.o.o.oO..p.P.P_n. ..@0..P........DIDATx..YS.G..G.]..N...t.6&.$..8v|.>{.."....m.3...../...X...*./.....z..Z...^-."|GT(T.K..Z..n..z.3..BT..Z....\.)..Y.....)..\XZs%..e../...........:....Z.R...,X...B....VCL......".~)P...@..P..8......YG..<...=..BLs..CX........0..J...I....Z..,....0g...i...B..}6.Eh.$.g.D1.k......... ..WYD....O..b~.~......U..s4..?...d0........x.g7.zF...........9..G*.A...~...=#.w0.1Z......K..BV..>....x.p...<LS...ft..(|...2XDE.Q...yc..$Mu.@.L...R=.X,.H....!.X).j../.-q2.....09.........\...&.bYk........j.o......../.u}..(5!.

                                                                                                                                                                                                Chrome Cache Entry: 929

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):259
                                                                                                                                                                                                Entropy (8bit):4.934032927917805
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6RlUFDA:t4noU/vmRxxVzMHUFX4Q0
                                                                                                                                                                                                MD5:F3AFFCB5D33857F7701EA77BB03026C8
                                                                                                                                                                                                SHA1:18EEE961EA2690791898EBE6A1BEE7C6DF0DA051
                                                                                                                                                                                                SHA-256:E3B0DCD76E8387AC87E54B1153DF400D9D5D2079DBA7AFB04AB0A31F8E50B173
                                                                                                                                                                                                SHA-512:D07A81CD18096FB5C3B6549950EAB68DA45651E1209F1CDF6441CFDE01050C6E5A0FC596A45B761F3D387902DF3F1706BBE7F97DDBBBD11AAEEC83A70D08F3DC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/trophy/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zm14-1-2 1V6h2v4.38z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 930

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):563
                                                                                                                                                                                                Entropy (8bit):4.367744360532535
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noU/vmRTKd2aCJAzyXDMhkVFCzzZvSbeW03LxgI:t4oU/vo49yXghf5UTI
                                                                                                                                                                                                MD5:3102D9E6EB6482A42839EFF1E5F4CB83
                                                                                                                                                                                                SHA1:151E7A7B018C590EFF801936C8B3165E21D1F388
                                                                                                                                                                                                SHA-256:A79054C0A39DB68BD70F2277EE512312190F32D0CCFB12B2B15A8DC833DA4772
                                                                                                                                                                                                SHA-512:4131362A77102F48C615E40ECC95599300A239BF339831DA47E85A328929EAAB6AC63B67D64CE6FCBEB120D85865F5415C2188877822861BADCE5B908D206A0B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/person_circle/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 1c4.96 0 9 4.04 9 9 0 1.42-.34 2.76-.93 3.96-1.53-1.72-3.98-2.89-7.38-3.03A3.996 3.996 0 0016 9c0-2.21-1.79-4-4-4S8 6.79 8 9c0 1.97 1.43 3.6 3.31 3.93-3.4.14-5.85 1.31-7.38 3.03C3.34 14.76 3 13.42 3 12c0-4.96 4.04-9 9-9zM9 9c0-1.65 1.35-3 3-3s3 1.35 3 3-1.35 3-3 3-3-1.35-3-3zm3 12c-3.16 0-5.94-1.64-7.55-4.12C6.01 14.93 8.61 13.9 12 13.9c3.39 0 5.99 1.03 7.55 2.98C17.94 19.36 15.16 21 12 21z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 931

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                Entropy (8bit):4.7187854291824936
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRvFjonQFWL4UUk+uUQRNru7u5WLp+:tI9mc4slhohC/vmVR9MQF1Nk+bQLL0LA
                                                                                                                                                                                                MD5:DFF69AA895E01665A126FC2141C94FE5
                                                                                                                                                                                                SHA1:4064D2365E13C8A346B1D4BBE31BECD3A18CF5B1
                                                                                                                                                                                                SHA-256:811E9985BE1AC4E4D630F4B232CEEE366801CB5F82EE306A574C1CE9F844F673
                                                                                                                                                                                                SHA-512:CDC9FC460CBDA1DA0EF8E7A079FCBBF717E800F732923607DFBFA57E00FD3E8A2B487E9D2FEA95294DEDBA9DA5CFD42491BD3AC65219AEC954A20CB90FDE49B5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/arrow_up/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="19.35,11.5 11.5,3.65 3.65,11.5 4.35,12.21 11,5.56 11,20 12,20 12,5.56 18.65,12.21"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 932

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):147
                                                                                                                                                                                                Entropy (8bit):4.91608759200102
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHxKFUV12pppTJQrK/:tI9mc4slhohC/vmI4xKPJTeri
                                                                                                                                                                                                MD5:BB349544319961A969D3B459602BC671
                                                                                                                                                                                                SHA1:961C29B064625EB266A084F294F970E0A2A953DB
                                                                                                                                                                                                SHA-256:489A97893CC1E6CD9267CB6B39BCC7DDC0D119A19408EF3B80E4F3798C78B1FD
                                                                                                                                                                                                SHA-512:56168B9E178135D180DE402FFD8BD2D0412CB86C40831CBE709A4034F0FCB628A12096C3981D487FF48E134558701F8F1A458BFA0E48402C8A4FB32C0A9393A2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_up/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18.4 14.6 12 8.3l-6.4 6.3.8.8L12 9.7l5.6 5.7z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 933

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):154
                                                                                                                                                                                                Entropy (8bit):4.827221770489101
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHTdEBhHIHWlYqY:tI9mc4slhohC/vmI45EBho+u
                                                                                                                                                                                                MD5:FFFE8FD3C6ACCC2FCFDD7B66EA25B99A
                                                                                                                                                                                                SHA1:13C31200084CB1EED7A746428D2B79AD34FF6790
                                                                                                                                                                                                SHA-256:55A060294343CAFA3539424536540547F25EFD13A1D2373D7A5E966CE74C5699
                                                                                                                                                                                                SHA-512:A6D8EB0393B4FB56D4B6025865F542B29AFEFAF7BB2B26E55C5B54974EB3B913E9A17AD54A8FE33525345AF3AD16EC60C06356582F72B3864731EC22C1838662
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_right/v4/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m9.4 18.4-.7-.7 5.6-5.6-5.7-5.7.7-.7 6.4 6.4-6.3 6.3z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 934

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):359
                                                                                                                                                                                                Entropy (8bit):4.955472444225813
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slzXdhC/yZqRIuZUoMLWlvSLrk91MLP25RjkxSRcATBrREjlC:t4BdU/mD8tKv9iDjkwRFTlGjI
                                                                                                                                                                                                MD5:7EC75F80BDA2F53D6568AA6412D83431
                                                                                                                                                                                                SHA1:9A94D2C509FE96BBD5A02971F066A1C1EEC6B3B6
                                                                                                                                                                                                SHA-256:D8869F288C1E21A843123729543F5677E9B28349789C2282609CEC8ABC4DE9C1
                                                                                                                                                                                                SHA-512:B2F2FE075F4AA2E0D73B4BF7B7F8BE3F43C6E6A7BF93165BE3178B7A20F5B0AE3B6CDC467B502EFEFE0337D5A98FA7039C224A3CDA6F455D70622B769314935B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_shorts_brand_24/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24">. <g>. <path d="M17.77,10.32l-1.2-.5L18,9.06a3.74,3.74,0,0,0-3.5-6.62L6,6.94a3.74,3.74,0,0,0,.23,6.74l1.2.49L6,14.93a3.75,3.75,0,0,0,3.5,6.63l8.5-4.5a3.74,3.74,0,0,0-.23-6.74Z" fill="red"/>. <polygon points="10 14.65 15 12 10 9.35 10 14.65" fill="#fff"/>. </g>.</svg>.

                                                                                                                                                                                                Chrome Cache Entry: 935

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):406
                                                                                                                                                                                                Entropy (8bit):4.651423707267608
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noU/vmRpRD3kuFTUgF1rwnSh0HBSDK+TFmGbu:t4oU/vk1kuFTHFASh0HBJ+S
                                                                                                                                                                                                MD5:07316364645FFB2C33FC257FCFB34571
                                                                                                                                                                                                SHA1:889C3EBC5FD9ED8556FABFD1C7B255D57E46B60B
                                                                                                                                                                                                SHA-256:0F10421652B17118A44D84E207A04BB972DBF38C444D56C1701F8E961FB6FF4F
                                                                                                                                                                                                SHA-512:3B4CCF3C9DF86926DB5765CFF9764CBAEEF277631D8D703C956CCB9071E124DBA9A398DEA8D1DE20CDEFC6E4ABDACAC637FF2D97141F4AB9284A830F20F534C9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/volume_on/v3/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17.5 12c0 2.14-1.5 3.92-3.5 4.38v-1.04c1.44-.43 2.5-1.76 2.5-3.34 0-1.58-1.06-2.9-2.5-3.34V7.62c2 .46 3.5 2.24 3.5 4.38zM12 4.07v15.86L6.16 15H3V9h3.16L12 4.07zm-1 2.15L6.52 10H4v4h2.52L11 17.78V6.22zM21 12c0 4.08-3.05 7.44-7 7.93v-1.01c3.39-.49 6-3.4 6-6.92s-2.61-6.43-6-6.92V4.07c3.95.49 7 3.85 7 7.93z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 936

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (41541)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):74197
                                                                                                                                                                                                Entropy (8bit):5.4551136708766705
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:1pbgXdxJkYuOm3Q+gXHcJXEal5yl/kPHTO677Y8PouA/sqk92474oIhfc0fnraJp:veHchBCdo25qMKcuktHzX+6UevL8F
                                                                                                                                                                                                MD5:1A385461F30E3F360D31F242FD6B3D98
                                                                                                                                                                                                SHA1:0C0D69D3D866E93732265776AE44FD02DB855D99
                                                                                                                                                                                                SHA-256:F89934AC0709430477B8A664F72035461A08E79AAB91944D71D695660D810C13
                                                                                                                                                                                                SHA-512:8F5957C1FB9DA9BC831E688F66F4DE1362ED2A2B7A557F9607C7DD93F99D7E07A339B52C350CE1CC236EC5A2B84AE9CE7FF53F12319C967CC4A3D6C5DDCFF161
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/1jvrml64dlmt60uoawzo2af88
                                                                                                                                                                                                Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=108)}({108:function(e,t,n){"use strict";n.r(t);var r=n(7),i=n(43);const o="PageViewHeartbeatE

                                                                                                                                                                                                Chrome Cache Entry: 937

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (2164), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2164
                                                                                                                                                                                                Entropy (8bit):5.007692541572839
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:/CpDuMY6wRQAQl07kBeFxDKNpK9xvj+Zy3t:/snIQAFhRl
                                                                                                                                                                                                MD5:68225657C41B94DFDD7669563FA18C80
                                                                                                                                                                                                SHA1:58E43494BC31122F06FCB3AA3764BE2883D0618F
                                                                                                                                                                                                SHA-256:72BCCD36C17AA93A7BB553557626BB720BE60CDE2357D817BD03AF6BE67CF08E
                                                                                                                                                                                                SHA-512:18441A68B88395A98A1721CE772AA98D0A05AC080E4C7C2A8A0598F46837FCFF8A1C5978E6A0C3146A088CCA632ED43B377FF63DB15195976AE958D35E9FB1CB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/65xtw2y5evpkuq3vtf8wiydts
                                                                                                                                                                                                Preview:!function(e){var t={};function n(o){if(t[o])return t[o].exports;var r=t[o]={i:o,l:!1,exports:{}};return e[o].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,o){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:o})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var o=Object.create(null);if(n.r(o),Object.defineProperty(o,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)n.d(o,r,function(t){return e[t]}.bind(null,r));return o},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=91)}({91:function(e,t){var n=document.querySelector(".language-selector"),o=document.querySel

                                                                                                                                                                                                Chrome Cache Entry: 938

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (405)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1600
                                                                                                                                                                                                Entropy (8bit):5.234459115233662
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:kMYD7i1NPxJ3nktBNuryNPxyhzs/fdkTRxuAoMylW6MumIcu2yNPxxQ34OZI86y2:o7iHY0rs9ORxvoMylxr2sQJ7DNzfrw
                                                                                                                                                                                                MD5:967DFEEC6A7FD39DC7FE665E776702E2
                                                                                                                                                                                                SHA1:AA15F9DF789871C3AFAC0D31962E1E71F1D9CD58
                                                                                                                                                                                                SHA-256:D432D0BB701BE738D8E070DBFAEE681AB412F157E5ADBC63099309FC2DFF6252
                                                                                                                                                                                                SHA-512:461D5EE5A265CD8DEFD3EB0C286DAA5DAC8C115621CA9420694DA308093C0DA6280B3366B3C1ED5B4BF106CB2BC9AAB827E63B36D4E71447153581ADB18298AA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.uf(_.hia);_.Yv=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.B(_.Yv,_.I);_.Yv.Oa=_.I.Oa;_.Yv.Ba=function(){return{Xa:{cache:_.gp}}};_.Yv.prototype.execute=function(a){_.wb(a,function(b){var c;_.qe(b)&&(c=b.Za.Nb(b.fb));c&&this.aa.JC(c)},this);return{}};_.Lq(_.Cia,_.Yv);._.l();._.k("VwDzFe");.var KE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Oq;this.ea=a.Ea.metadata;this.da=a.Ea.Fq};_.B(KE,_.I);KE.Oa=_.I.Oa;KE.Ba=function(){return{Ea:{Oq:_.kE,metadata:_.lUa,Fq:_.hE}}};KE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Bd())?b.aa.fc(c):b.aa.aa(c);return _.Tj(c,_.lE)?d.then(function(e){return _.Wc(e)}):d},this)};_.Lq(_.Hia,KE);._.l();._.k("sP4Vbe");._.kUa=new _.qk(_.Dia);._.l();._.k("A7fCU");.var pE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.nL};_.B(pE,_.I);pE.Oa=_.I.Oa;pE.Ba=function(){r

                                                                                                                                                                                                Chrome Cache Entry: 939

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):415
                                                                                                                                                                                                Entropy (8bit):4.495473856679165
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4noU/vmRIESMmpa8gQL8nJK18IyNzT+OjHf8:t4oU/vwSMcNgQL8nJKCzN1jHf8
                                                                                                                                                                                                MD5:AEBBF536BB5109D9C8BA51BB520CC801
                                                                                                                                                                                                SHA1:EEF20371B44CC4E85027D01DBB2690DED70DF957
                                                                                                                                                                                                SHA-256:E2A570823965E0A19930FAED9A0C8213AF0092327BFE7041F5A50D7E6312360F
                                                                                                                                                                                                SHA-512:A65789396E46C765EC4874AAE6996C12145CBD9C8C2E17E0B47AB80E33FD4F6D0FC13B9F282B72AC1A8F32A1D5953E97C1CF483E36A04B2C2E68E921E48B8510
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/youtube_shorts/v8/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m17.77 10.32-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 3.24 2.53 5.07 1.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-.07-1.42-.94-2.68-2.23-3.25zM10 14.65v-5.3L15 12l-5 2.65z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 940

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (7735)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):8059
                                                                                                                                                                                                Entropy (8bit):4.915169329208675
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:NRRGUcHwbE2ZH0LqEcbuCUY3bkQsS6SxSrxXdvH7hJWJw:tGUcHVqEcbuCp3bkQspksxXnJWJw
                                                                                                                                                                                                MD5:A9BBD8F75ABCBBD2DB26FAFE60A42251
                                                                                                                                                                                                SHA1:E340BCEDDE95C36FAB178EF783C3DB141B2A349F
                                                                                                                                                                                                SHA-256:77F24D6B0A85A38EBA36E808503F24A7525C2090B8235BD4B2F9F7156C605698
                                                                                                                                                                                                SHA-512:FDC83DD24C73BAA59BAF8EB1DB5D120746F51EBD2A980FDE752E38A4BD4E8D72F386EF594117597A41960B84B698187F2386BC1E56DFA5D4816DCFC46A8C86CE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/sw.js
                                                                                                                                                                                                Preview:/** 3813407428062532269 */self.document = self; self.window = self;var ytcfg={d:function(){return window.yt&&yt.config_||ytcfg.data_||(ytcfg.data_={})},get:function(k,o){return k in ytcfg.d()?ytcfg.d()[k]:o},set:function(){var a=arguments;if(a.length>1)ytcfg.d()[a[0]]=a[1];else{var k;for(k in a[0])ytcfg.d()[k]=a[0][k]}}};.ytcfg.set({"EXPERIMENT_FLAGS":{"H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"att_web_record_metrics":true,"clear_user_partitioned_ls":true,"compress_gel":true,"csi_config_handling_infra":true,"deprecate_csi_has_info":true,"disable_child_node_auto_formatted_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_use_scheduler":true,"enable_ab_report_on_errorscreen":true,"ena

                                                                                                                                                                                                Chrome Cache Entry: 941

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3974
                                                                                                                                                                                                Entropy (8bit):7.865677850258462
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:T5/XmKZna85KsnUVilvinWNi49VnUW+81k619d4gs91:T5fmWSglvlnbzmgsH
                                                                                                                                                                                                MD5:5302BBCDF069CB20105A658263ABA408
                                                                                                                                                                                                SHA1:4FD8C3999593A554E27ED514056DCB78C67CFB78
                                                                                                                                                                                                SHA-256:D56A11EFA23568BFC74D0133F6E5E94C5C3D5A95F84FDD081BFCAAE5B982E741
                                                                                                                                                                                                SHA-512:08298FF2D1D952D11182FCF97295ED129369425AAD35A5D5D0C1DF2EA499C869667D5BF83952F3E2F5650CB5C674211DA46C0CF8CFD7A0A670ECE37F416B4227
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/Yxvus5PSvCa2WXrchCax11Dg_1HWOqlsyTQKpNvibipOO4e9FIGsKbnT4Pj7DzUXO4sqjjxcQaM=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D..........................................:.........................!.1.."AQa.#2q....%4..$3BRb.......................................3.......................!1...AQa."q......2R....B..............?...m...Qa...2Tp...f.....x.HYmK{..F. D..1T....s.q.L.9..'.y|.........:..m[..."...J....."D.$~....;z.0\.H..'...cd..|2..$.O?.s......}:..Q.....c...i.../{,...*.\..9=.o...;.yf..J"x..z$.Z..j.....S.@1..G..1...Z.B....:..C..7M!.).......M...T.$.P....f....:.k...n...Em=Ew...-r..W(.T..4H.`u...y ...$u"c.Z..TC.&JA...'.Y.......e...wl..O.U.O..'....@.'tA......&.X..t'.1.J.U...s.8.I.A...Rc.;.wZV...#..[.!..G..v.,j..Uq.b.]..=........<.`'...[.?c[.[....p..I.4;@.}..w...)..i.9..bKm..V......*Ks.A.^8.L.jz..}.Iib..Jt..~...T..2]e1z..KO....Q'.Q...K.......O].l[!S.._=p.ADz{...../..z;.....Ne@*.w............OJ......T.M .8.L.zoi.Q..5...

                                                                                                                                                                                                Chrome Cache Entry: 942

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 49 x 74, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1633
                                                                                                                                                                                                Entropy (8bit):7.352151724937379
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:Qy3Hwa/3ffWoAf6t+snxsGhlYUcGwMMQ1:xQaXfKG+IJcJM51
                                                                                                                                                                                                MD5:72EE577BCC1A6A29D0422C3EB1248861
                                                                                                                                                                                                SHA1:800818D8D4A3E67D49ED2A3A935B355F8452DDDD
                                                                                                                                                                                                SHA-256:97FADFDD7D274DAABD9F7D79C817F4A9FACC08EBA67E38284698525E8A1FFFD0
                                                                                                                                                                                                SHA-512:A373DB5E786A91D299394B45D707A067CEC708966B8757BF84F5BEF0F167E7EE4388C4356468526A6A8B4AD3521773FE78FDE18422B16F730D9116245544171B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/7NqDjYL3eb9.png
                                                                                                                                                                                                Preview:.PNG........IHDR...1...J.....%.L,....PLTE.....................GpL...........................FFF......ooo...BBB.......................................NNN...uuu...............................................................999..................,,,.........AAA...............444......................................................777...WWW......:::.....................333........CCC........................zzzhhh....."""{{{...jjj.............%%%...555............................................bbbccc.........rrr......sssrrrsss.................................to.K....tRNSfJ....\.Td..hLfl.xP6.\x.....jf..|..N|`........N..R`..n..^.tVp..V.v...z...t.|.."^v.hfBlZX.j...tb..p~b....:4r..x...h......n.......n.t.....`.`.....b....b.................TIDATx^..es#G.....dY`.33...!3C.0.c.....~.|.D+E.f....}.T......j...3..3...)C."...'..........GK._..........J.....%..vw:....D&+5.fl... ..@..Q.4.$.h.&Zb..N.....b-.h.".....R'.b.n...!.T#..N.G.a..UEg.DZ.3.....OtC{......+.7.......E.$...

                                                                                                                                                                                                Chrome Cache Entry: 943

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):84887
                                                                                                                                                                                                Entropy (8bit):7.986374265048622
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:mMJfp/FdRS7UmgGy4SwBAu0t4EMabfkJydSA/wJ0ULXpQGR3GQqXUdv+9o:mMRdMLgGyMBp0+gzakVIJF7u0Cov+9o
                                                                                                                                                                                                MD5:34AFCFAEEAC219C9A7124525C82423DD
                                                                                                                                                                                                SHA1:98BF88F2A136BF29421F8822ADDE425B7348D8BA
                                                                                                                                                                                                SHA-256:89CA07757BAC7C12D47694D115DE327AC5CCD6F6C931FC4F931A419290DE7756
                                                                                                                                                                                                SHA-512:3A82D6AEB00BB09CFB0D8E1011AA23546B018DF9FE4CBF65EEA3265E47859C128D17209D103E5BD728F5C43FAB647A6FA0F201C7F67F8FD80C3599924E414C81
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426099774_307413115656609_1497203190952538385_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=dQS-IQxA3ZkAX9Wnxbm&_nc_ht=scontent-lga3-2.xx&oh=00_AfCjC2Qz_fbOasOqCvSRsaRZmXVOFfT0LfSajJOqx91PWQ&oe=65D4485D
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000281e0000f2510000e85400000d5700003a9500007dd60000b6dc0000c1e000005fe40000974b0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".................................................................................P...M.M...jl..m.=.I..c....VX%0.i.:......'m.M...2p.).>i..Y..y(...."..Ert...*.....".... ...W(.....?}.ud;_p....m.*4.4p.w....:9.K.....t...KL..;.......:rAA.....N..QPT.P....8:A..@...R.P.^..]U.^.I...u9.....5.*;......X.H......)......8.F....q".l.....G.o:sC..N....U.P...)....R.N..P.R....).#....m.21.....5W.|1.{.H.m..V..l.R.]."PE..E.;y....aM.O....y..t......'H . ...P).)I.hr).t... R.G....=.wZ..>4sS..n..,qEV.D^.o......G.........{Nyq.+O%5.oT.T.A........DAC...:EE..........A)D#.8a9ww......l.....+s..yY...xy.zxy.^./...y....q............]1.RQs...IA...IA...RXD%.BXD%.N'rW. r .@.x)..

                                                                                                                                                                                                Chrome Cache Entry: 944

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):789
                                                                                                                                                                                                Entropy (8bit):4.4194384212801
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:t4takfIIJEGBA8rb0CklxqTaccoUZ/ES2mM:kGGSVC8Giu
                                                                                                                                                                                                MD5:B552B4C85CA1E2238DB395B9A49411FF
                                                                                                                                                                                                SHA1:D8D5C6B8E8253732F1DD1CCE2F8C4F3C1F1BB1BE
                                                                                                                                                                                                SHA-256:949AF1BF7118AF3ADA0A087666E6E763CA627DBEFB1EB2E3B978210CFE808FBA
                                                                                                                                                                                                SHA-512:62DC81FC15CE62AFD2C22C36A05C5C5CC6BB4E5231C8BDF11143CFA8C950A6A161B693BE7B93AF6BFD9A0C348D6B4A49D9956706029E1307135B4D191869D837
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/creator_studio_red_logo/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill="red" d="M11.13 1.21c.48-.28 1.26-.28 1.74 0l8.01 4.64c.48.28.87.97.87 1.53v9.24c0 .56-.39 1.25-.87 1.53l-8.01 4.64c-.48.28-1.26.28-1.74 0l-8.01-4.64c-.48-.28-.87-.97-.87-1.53V7.38c0-.56.39-1.25.87-1.53l8.01-4.64z"/><path fill="#fff" d="m12.71 18.98 4.9-2.83c.41-.24.64-.77.64-1.24V9.24c0-.47-.23-1-.64-1.24l-4.9-2.82c-.41-.23-1.02-.23-1.42 0L6.39 8c-.4.23-.64.77-.64 1.24v5.67c0 .47.24 1 .64 1.24l4.9 2.83c.2.12.46.18.71.18.26-.01.51-.07.71-.18z"/><path fill="red" d="m12.32 5.73 4.89 2.83c.16.09.41.31.41.67v5.67c0 .37-.25.54-.41.64l-4.89 2.83c-.16.09-.48.09-.64 0l-4.89-2.83c-.16-.09-.41-.34-.41-.64V9.24c.02-.37.25-.58.41-.68l4.89-2.83c.08-.05.2-.07.32-.07s.24.02.32.07z"/><path fill="#fff" d="M9.88 15.25 15.5 12 9.88 8.75z"/></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 945

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1998)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):164058
                                                                                                                                                                                                Entropy (8bit):5.620168931263726
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:rvX5Lw5UlDJVZHL08oy6CiEETgDAGXoI7xuSrnCvnxtsmEtn4DtATIcT3PY0AU:rvX5LKUlDJVZHL08oyRiJsD7oIS/sHnh
                                                                                                                                                                                                MD5:4F02B8210D601E5D2FFCFEF6119A59CF
                                                                                                                                                                                                SHA1:721EDDBC9B2101A184F3C7012FAF56D7EE0C1148
                                                                                                                                                                                                SHA-256:ECA39EABBE3F499DE76A99621B9C6A38B6013E8820C8EC0B407B48A57724F044
                                                                                                                                                                                                SHA-512:80D12466594D629A538BD9D317EF486B0127EF8638B5455F45C7A4F1C43A054C56B9D5936820BE2DF5EB34D6856995934AE6E9B52019DF924AFAFA4AF2AE64D0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js
                                                                                                                                                                                                Preview:'use strict';var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ca=ba(this);function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}.function ea(a){function b(d){return a.next(d)}.function c(d){return a.throw(d)}.return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}.f(a.next())})}.function r(a){return ea(a())}.function fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:function(){if(!d&&c<a.length){

                                                                                                                                                                                                Chrome Cache Entry: 946

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1116)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):74033
                                                                                                                                                                                                Entropy (8bit):5.496125678356682
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:4GIr9iykWXc8VV4ucbxiyXdpGupDMbSrOLR0QZWtPWDG4nFjI9rkiDyVO9HI4Ckn:h45nb3nxQIiENg5Bi+C02by5
                                                                                                                                                                                                MD5:1D50E206021F1BBACF8EC3080B04264A
                                                                                                                                                                                                SHA1:5024B3A6930C7F8D47DE1472B38BA590A657F882
                                                                                                                                                                                                SHA-256:9EE512AE80E59BE486F738680AA45ED4E31E7458A0B48F40128637B772224261
                                                                                                                                                                                                SHA-512:5E065ED27D57432099060906B79C5B4849236CEE091C7FEDD8D57FC5732E5746AC5E5366497C4F31AE7A79D52EDF82104463A8E042D411820B219940BF2A9684
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&family=YouTube+Sans:wght@300..900&display=swap
                                                                                                                                                                                                Preview:/*. * See: https://fonts.google.com/license/googlerestricted. */./* cyrillic-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. f

                                                                                                                                                                                                Chrome Cache Entry: 947

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (405)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1600
                                                                                                                                                                                                Entropy (8bit):5.234459115233662
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:kMYD7i1NPxJ3nktBNuryNPxyhzs/fdkTRxuAoMylW6MumIcu2yNPxxQ34OZI86y2:o7iHY0rs9ORxvoMylxr2sQJ7DNzfrw
                                                                                                                                                                                                MD5:967DFEEC6A7FD39DC7FE665E776702E2
                                                                                                                                                                                                SHA1:AA15F9DF789871C3AFAC0D31962E1E71F1D9CD58
                                                                                                                                                                                                SHA-256:D432D0BB701BE738D8E070DBFAEE681AB412F157E5ADBC63099309FC2DFF6252
                                                                                                                                                                                                SHA-512:461D5EE5A265CD8DEFD3EB0C286DAA5DAC8C115621CA9420694DA308093C0DA6280B3366B3C1ED5B4BF106CB2BC9AAB827E63B36D4E71447153581ADB18298AA
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.uf(_.hia);_.Yv=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.B(_.Yv,_.I);_.Yv.Oa=_.I.Oa;_.Yv.Ba=function(){return{Xa:{cache:_.gp}}};_.Yv.prototype.execute=function(a){_.wb(a,function(b){var c;_.qe(b)&&(c=b.Za.Nb(b.fb));c&&this.aa.JC(c)},this);return{}};_.Lq(_.Cia,_.Yv);._.l();._.k("VwDzFe");.var KE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Oq;this.ea=a.Ea.metadata;this.da=a.Ea.Fq};_.B(KE,_.I);KE.Oa=_.I.Oa;KE.Ba=function(){return{Ea:{Oq:_.kE,metadata:_.lUa,Fq:_.hE}}};KE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Bd())?b.aa.fc(c):b.aa.aa(c);return _.Tj(c,_.lE)?d.then(function(e){return _.Wc(e)}):d},this)};_.Lq(_.Hia,KE);._.l();._.k("sP4Vbe");._.kUa=new _.qk(_.Dia);._.l();._.k("A7fCU");.var pE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.nL};_.B(pE,_.I);pE.Oa=_.I.Oa;pE.Ba=function(){r

                                                                                                                                                                                                Chrome Cache Entry: 948

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):78
                                                                                                                                                                                                Entropy (8bit):4.858681545591168
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5KVErcHghI4KuP0WTC:tI9mc4slmR4rTC
                                                                                                                                                                                                MD5:5FFB1290441ED5E56850CC92DB640DBA
                                                                                                                                                                                                SHA1:ABD55D2B6EE392BBC8A89FDCE5B8560E37119D90
                                                                                                                                                                                                SHA-256:C74EF8500A3AE98D1E16F03B030BFD6726DE72A8911FC397D3301E4B9D86369B
                                                                                                                                                                                                SHA-512:83826FC55AF7335F3AE5E14CAD4056942F3F9C3FA3781258A771710DE1D32EB3412897F6AC3E09090192BE11EB490F996EB475E7B563EB6CD6B15A8F3A1B008F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/play-arrow/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M8 5v14l11-7z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 949

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):384
                                                                                                                                                                                                Entropy (8bit):4.820720215490487
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4CpBSNwLSoD0pVhyVLT7UiHQ3aju2lQjGVT7UinwFju2li:t47N9U/vmRqBKbsL3RQKju2lQ03VwFjs
                                                                                                                                                                                                MD5:BD5B52813BF62EC230C9EF682AD48DA5
                                                                                                                                                                                                SHA1:AB4B59D9F48A229B4D5C6C6DE9E4BF8D4AF32605
                                                                                                                                                                                                SHA-256:179E849AAD715CEDDED335BFB09228C4985D113BC1EC61FB7C95785B8E6D941A
                                                                                                                                                                                                SHA-512:7AABEFC130160D98B3EF047EAB303D13DCD0BDEC71A24372716FA060FE35AA91D86B1C10CAACC36B0332E9B3B6E59141EC1B32DF7E50543D0927ED0ACAB881F1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/gaming/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m16.97 4-4.99 2.8L6.99 4 2 6.8v7.6l9.98 5.6 9.98-5.6V6.8L16.97 4zM10 12H8v2H6v-2H4v-2h2V8h2v2h2v2zm5.5 2c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5zm3-3c-.83 0-1.5-.67-1.5-1.5S17.67 8 18.5 8s1.5.67 1.5 1.5-.67 1.5-1.5 1.5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 950

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):214
                                                                                                                                                                                                Entropy (8bit):5.096829767629689
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4MJqgzQFqYgXT085Y:t47N9U/vmRYOF4Tm
                                                                                                                                                                                                MD5:BDC934DCE4645CFA785C33E037A00EFF
                                                                                                                                                                                                SHA1:87281A6721F6ACAE1DA886D68A9BA04F009831DC
                                                                                                                                                                                                SHA-256:09C41C2AC9873188C095279472467BE0EB4166C5E22AE52BA04E937AC94FC203
                                                                                                                                                                                                SHA-512:74331EE305E92CC3BF172624469D9789BE82A2D48EB1791210931C125F40298EC96F3875D8CFD25E8F323071D041930CDD1BADFD0AF9B032D290B56E3E838048
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/subscriptions/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 18v-6l5 3-5 3zm7-15H7v1h10V3zm3 3H4v1h16V6zm2 3H2v12h20V9zM3 10h18v10H3V10z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 951

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):114292
                                                                                                                                                                                                Entropy (8bit):5.5528653263166285
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:BfaN1hvawAB3MAYcKh+CY0YcQ1rFPyY5c/F1FRLf+aD3Wp94yXCQC4NIT3PTtSGa:BfaNbAB3IacQLiPFRLf+e3g9bXcAITk
                                                                                                                                                                                                MD5:EA5144AB403234BE650A76530D1CB29D
                                                                                                                                                                                                SHA1:67DEE97C0AE2F912CE9F4CB1ADB9181857A01DF3
                                                                                                                                                                                                SHA-256:6EA25790432AA3DF786FF6518EAE8400D61081EE2A2206082C24B3FC6D4705DF
                                                                                                                                                                                                SHA-512:74998F4A928418639BCC2C4EE5BE2DABDC01D5D4C5E3C69BA606E9A0757D173EC542BBD3BD2CFC31CBC17057B421773778997A80F1C4925022DEE0A0B4CA0241
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Atb=_.y("ltDFwf");var AU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.$r(this).fc(function(){this.Fa.length&&(this.Fa.forEach(this.f9,this),this.Fa=[]);this.La&&(this.La=!1,_.Bq(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.Bq(this.mb,"transform","scaleX("+this.ja+")"));_.$q(b,"B6Vhqe",this.Ca);_.$q(b,"D6TUi",this.ta);_.$q(b,"juhVM",this.Ma);_.$q(b,"qdulke",this.aa)}).build();this.ea();_.zg&&_.$r(this).fc(function(){b.ob("ieri7c")}).Ae().build()();_.ez(this.oa().el(),this.Sa.bind(this))};_.B(AU,_.J);AU.Ba=_.J.Ba;.AU.prototype.Sa=function(a,b){Btb(

                                                                                                                                                                                                Chrome Cache Entry: 952

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 25 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):804
                                                                                                                                                                                                Entropy (8bit):5.9272601627884605
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:6v/7ykl/f/je0aVMrCwGPlc+Zen0JTSdoc9EdyBw3w6xuS8SNGqsaNg:onBaVHwGPlxen0NSucwXoSJN+8g
                                                                                                                                                                                                MD5:C156C107AE735C5F3813220235E0D11E
                                                                                                                                                                                                SHA1:F655A14E144551432AAE9BA0A7FE0E237A65AE51
                                                                                                                                                                                                SHA-256:D75C74B337113A0C65EBFF05ED63A487A0E158BC7246B987A28943667DF46C5B
                                                                                                                                                                                                SHA-512:A2729CA423327C0855BDC68374AE0EA6B211043EBD39A63B7248BF4E288B9641BF3F827EA01C4FB0444BCFBC68B6E06B51EEDE746668F14D4F7225B9B941CC81
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/q8Uic1K195T.png
                                                                                                                                                                                                Preview:.PNG........IHDR.......@......,n....PLTEGpL....................................................................................................................................................................................................................................................^.g...QtRNS..d....(..........B...:.>...0..XVLJ|<.t....Rv....6D4n.......@x.8...h..\... .NJ.!V....IDATx^...@...4Q@.yf.:1l.9.../3.M...l..U.#........$?...........kI]|.$GI&#.{.R..../d7$..x!.c..X..\B>...x./..X..[....SQ!@c\%..RNr"rrv.!.b.%.......j...n,...u..*).y.]."..r.b..P...B.FU....`.........s...,..y..(.3...!$.. ....F.(.a...g.?R.F.B:....$C...t...........\..N....c..2..`..VH.1..mF>.....t.L.MxDY....Y..U.6.$...O.(.....U.)/.e.mk..$.^.N....-........:.U.d.7...yp_i...Y.z....t..=...f#Q....IEND.B`.

                                                                                                                                                                                                Chrome Cache Entry: 953

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):2541
                                                                                                                                                                                                Entropy (8bit):7.770084886705757
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:UegjJZZ1Q/dC3G8NLopxtnkCBGo/yIDCqJwRE4tINEODfzg:5gNZZ1Q/dzCofWRr2E67g
                                                                                                                                                                                                MD5:BB9861FADC6ACB086E21BA033EE6518E
                                                                                                                                                                                                SHA1:4E541929D0336DB12DF5283B5F1FEA18701E26AA
                                                                                                                                                                                                SHA-256:AFE455512FB2E1634BE3FC4B822091FB6D925E8270DD00EC6E433A9F92B940B9
                                                                                                                                                                                                SHA-512:9C34D5315D2E80161826C05B5A38030451229258B8544887F150814CF0A8E9E6959BC16DC1EB04FDC635283185A1B71D6FB308850839485AED8BE1F124DF089F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/ytc/AIf8zZT50xdR785hg9_VXDPzZ0lgd85TC9O2ds07NHuo=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D.............................................7...........................!1..Q."AB..2q....#RSa.b.................................../.........................!1AQaq.."......Br..3............?..<.."Kk...6.-5...z.0D..[.W.2.....0..x.....AE..........{~._........z!X..Us...0D.a.*#.Fn..`...F...S.P....SO.......U.$....l....{.1...z.qj..7I4.x.....k.I......{.Q.Z..T..p.=....e.\.&....;...<..VA..6.O)A.....T.u`..*;(....M.....i.g.31..9w...+S._.....n..}W....s<.F.....o.........yMG...!w.M..:kL..........;`....."0E..U............3.r....Qj8b......<K,H.Vi.......Q..A...6....).R.Kr.H0u ....pV7...P.........$..t..4.....R2...nV8.")bY...I8..Q.]....t.I.........+....+.G.bm....5.0.t*1.TSe.{.._.X....U..kS..z..F?.'..t..%2.`.I.h^U{..]@.$z..yJ....G.............G.e.^.2..l...U..0E..#.I=.....G....o.

                                                                                                                                                                                                Chrome Cache Entry: 954

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3787
                                                                                                                                                                                                Entropy (8bit):7.868876153429024
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:XTiRiGMdq7ISsogYvo3bfR6CjhyoyET5wvcw09QGxq:XuMVlYvorfRLQywUwr
                                                                                                                                                                                                MD5:3CDE080C655B12BEECC669A1DA692055
                                                                                                                                                                                                SHA1:74AD6517193A2D47BFBDE9435E5E3BA807A45EB2
                                                                                                                                                                                                SHA-256:7E871F38FB00B80073BC62AA83AB6DBA760B6ECF3A5BE76560C34EDB7E88A763
                                                                                                                                                                                                SHA-512:DF275867F0BD9EDCBB55B056BDEE26F566D83EDB6F1CFFD547E2948A5A6B36115405482643D2E6BC55AF686A19AD2DDAFD2EBD560361C43F17089D8F116D1F52
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/CoYiDB8ojHTQvSwr9h8clzpcm85wiFaHroW0MaVgTnDEXAIMxhGlzC5Vwo9N3-z3obfVqc_G62I=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D...........................................4...........................!..1"A2BQ..#a..35Rbq....................................9.........................!.1A.."2Qa.q....#3BRb.....4S.............?......~.B.B.B.B.B.B.B.B.B>.....CO.-Q3*D..c....I...:......O ..`71.....1.v_...Wl..j"..S....3....OyH......n}.P.....SL..yh....].<.....H...l....p...-.}6l..T...t..=.)?>:.../...<.......%.(...,..{...s..R.*l..q....:T..+7..-..R........>[.j.w..n.y....;....i.....0l~..0..;...~.)YG.....#...{.yE....t.%)k.b@..RAOP.q..xc.r...qU.g..Z.sd...*fK.._.1.Ym..S...........~..|-W.{. ...R.x.I......]N3..2z...:....KO.Kg...(.#)WPv...=....k.....9v<......A.."!. H.'.\.5W..Nq...x..M2Z-+.M.1....i.R.I./H.}.#.9.?.....S%.b.T.3...q.....j.(,Y.`3...y.,V...ht..3.....!...v....v.zP z.a.YX.....'..].I*..*......o.....3......fvTU...3....-..*..}.

                                                                                                                                                                                                Chrome Cache Entry: 955

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (715)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):50702
                                                                                                                                                                                                Entropy (8bit):5.373070303650078
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:Ifd/sRuiALPAavkj70bI5D4nDltOC2B7F:IfdURZGvkjob44J8F
                                                                                                                                                                                                MD5:44CA3D8FD5FF91ED90D1A2AB099EF91E
                                                                                                                                                                                                SHA1:79B76340CA0781FD98AA5B8FDCA9496665810195
                                                                                                                                                                                                SHA-256:C12E3AC9660AE5DE2D775A8C52E22610FFF7A651FA069CFA8F64675A7B0A6415
                                                                                                                                                                                                SHA-512:A5CE9D846FB4C43A078D364974B22C18A504CDBF2DA3D36C689D450A5DC7D0BE156A29E11DF301FF7E187B831E14A6E5B037AAD22F00C03280EE1AD1E829DAC8
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js
                                                                                                                                                                                                Preview:/*.. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License... Copyright 2016 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,.

                                                                                                                                                                                                Chrome Cache Entry: 956

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1726
                                                                                                                                                                                                Entropy (8bit):7.085955604230639
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:g0/IFiWuaMCy85MGXu/0bsEM5zodnnee6vIGM:dglfKhcDM5kleeMI5
                                                                                                                                                                                                MD5:F9C5D189F0FB159985F38CD843F2E2F9
                                                                                                                                                                                                SHA1:1EB6FB9AED8EB77CE4DE23752007EF44BE5A2681
                                                                                                                                                                                                SHA-256:B1BAA078510059D1F18DD2326B6507B97291192BE4546D3DC3A0F814AE057585
                                                                                                                                                                                                SHA-512:124AA0B679986396ACE451699CED074FFE0835C9C3C0AAB90444FA2F9402A2F8D54198984ED65B0AD94747D087341267C552304FACE550067ECA8633932EE053
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/340075471_902769377669399_3844497347799448542_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=0TI1H3M7l_cAX8GeFFj&_nc_ht=scontent-lga3-2.xx&oh=00_AfCX1EtPWDLi6vU5vucR1PWKnYA8drPaled63zvR-Nh2vQ&oe=65D2FC93
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000e201000082020000c702000011030000e1030000a1040000dc0400002a05000071050000be060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................M....c...X..4>..#c..K.y...EO`..by.Yrm.Sz.+s}..<.P.).....Lc.....".........................."1..!A............q.k.L.N..K.i.[_U.v}..fpd.'2..Q9....S[em.Tci...x0.F.U.Yl}F.v..9.0..*.w...(.Td..pNc..3{'X...k..K.lDg.^.'..!%...~.t...!.......................... A!2Q........?.@.B)..Q.K6E.58z...6.*...$\o.........................!..1.........?.l.M..v5.*]..!.v....,........................!1."AQ.2r. BRaq...........?..f.@....j4....h|z....&t...lyi.{.`QmN...p......M..q..=..z......L.u..t.X.W...7..'.....N.....5>[..+&..0T..U]A.Y.V".a.4.@........Qr.=Ku:N..s.X...Wa}.e;..a...$....................!1Qa.Aq..............

                                                                                                                                                                                                Chrome Cache Entry: 957

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:PNG image data, 144 x 144, 8-bit colormap, non-interlaced
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):729
                                                                                                                                                                                                Entropy (8bit):7.234317148111566
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:6v/753iqqqqqqqqqqqqqq8apRTOe/RlzL064pdYTCrQQXHth6oHS0iwPuOb254iu:u3iqqqqqqqqqqqqqq8sdOe/RBL0NpdAM
                                                                                                                                                                                                MD5:F6E5A9215D13C4AEF31D125532228410
                                                                                                                                                                                                SHA1:CF2AA58CCDDC2B414CAD4A28394EF66CD2AE9FFF
                                                                                                                                                                                                SHA-256:8639DB0DBAA462E7BC11D7884C3A6CB84275DC988811CD2BFAF5CF2E65BC0FE0
                                                                                                                                                                                                SHA-512:2468FD00812806E44A2EB1AEF7F408D643DCFBEE655802E69B62DCE21F84AE3EC6E50F6612F332CB35FF53EC4792104C27DFD6DA36327FBEADE9D7FABC7C3412
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png
                                                                                                                                                                                                Preview:.PNG........IHDR...................cPLTE.......................................................PP.......... ..........@@....``.00.......pp........tRNS.@0 p.....P..`....Y.....IDATx...Ub.0.EQC.(.2..W9%......Y...eg.1..c.1H.C..$z.. ?......M.*.....R.. +.}.}t_0.m#.....T.....gje.9.7u..%.7...y..Q.D.Z..^vW..x......(.G..!R^..)..j4P...B.(H...igA(j.d...?...,.....DM8ZZ........:8...uCG.'...P....\....=..\<.\......=c.......H..`...+YD_.H...6vHa ur.....&.vJ.@.R.p..Ni.@.)..i......#.vJ.@.)...tJ......+..*.....-.S#...u.....}-.\.N..{.....m._.A.."n)..l...a...CmzV.ma....-D..K.....3...x...VH.i...V.2..u2..).J..cU4.....VX......\BC.`...V..:.(:.Y.(..h.O.\..dcC.Q..:..~Lm..&..{v]z0....9=....-/.O.g.1..c.1D..b..;...F....IEND.B`.

                                                                                                                                                                                                Chrome Cache Entry: 958

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):332
                                                                                                                                                                                                Entropy (8bit):4.296126422761529
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4FCvslQHcUiC7Q3ajuWskpwpWvWuMUMU2ldUiiW8kWuMUMUy:t4noU/vmRUslQ8+QKjupkpwpWvWuMUMk
                                                                                                                                                                                                MD5:F94123242618D16B950113BD6F22229D
                                                                                                                                                                                                SHA1:28B2E7A4ADB970446E442AE187E07328A68C1687
                                                                                                                                                                                                SHA-256:EC4C1E58EBA5A80E78C1B52486930F60634B4940322F230C236ABDCFD9F92DEC
                                                                                                                                                                                                SHA-512:E54B679A15465BEF172F1C364E34337B0C97D92C0F6C444253C8B69CD7147FD728DFEB1CDFA0DB64F0C13DC04999FB7CCE3C6CF49E77B4D1BA50798D9EDB3D94
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/overflow_horizontal/v4/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7.5 12c0 .83-.67 1.5-1.5 1.5s-1.5-.67-1.5-1.5.67-1.5 1.5-1.5 1.5.67 1.5 1.5zm4.5-1.5c-.83 0-1.5.67-1.5 1.5s.67 1.5 1.5 1.5 1.5-.67 1.5-1.5-.67-1.5-1.5-1.5zm6 0c-.83 0-1.5.67-1.5 1.5s.67 1.5 1.5 1.5 1.5-.67 1.5-1.5-.67-1.5-1.5-1.5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 959

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):146
                                                                                                                                                                                                Entropy (8bit):4.927838870881226
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPPQGZYurgvCo0/:tI9mc4slhohC/vmI4PPQG7rQCz
                                                                                                                                                                                                MD5:F00EABC2D958B20D27018698E9EE9D5A
                                                                                                                                                                                                SHA1:F1924FD47C49C7B40C3AC7B983137345C7D36D4F
                                                                                                                                                                                                SHA-256:36EDBAF2D04F3475DE1BA1B3EEADDCA06F232CA0B35AF734A218A8974B9F0D9A
                                                                                                                                                                                                SHA-512:4532BE68AF977C96DF2A768C2059827142A8F0773F2010CBF160B9F81B2AEEEBD635AFC2092DBA38CF355B0912DEF6DD51E601FE6112EE944BE28A122FD4B60E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/bars_3/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 7H3V5h18v2zm0 4H3v2h18v-2zm0 6H3v2h18v-2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 960

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                Entropy (8bit):4.760511517259426
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRviTOnQFOaZ0mbtUUWcFtTcFM4UXo:tI9mc4slhohC/vmVR6q8ZvNbfQfirc
                                                                                                                                                                                                MD5:9C452955A4281F736C8786F3C0876419
                                                                                                                                                                                                SHA1:104D443B65C15A1CA934FA449520DC81D3C067DF
                                                                                                                                                                                                SHA-256:5968B4C826F14A991A83B0FF27573BD4A20FD5BB16F79140D399C2E7413BED10
                                                                                                                                                                                                SHA-512:F66BB34FA7FDAFBF4516105B2AA65315BF6836A71EB98043872E454988A2B17CF7F62254E234C7F07FC282C8926E690388F7F65F186823FD8478D7902ABC7B65
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/arrow_down/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.65,11.65 12,18.29 12,4 11,4 11,18.29 4.35,11.65 3.65,12.35 11.5,20.21 19.35,12.35"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 961

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):327
                                                                                                                                                                                                Entropy (8bit):4.811141801937251
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4T7DmkHIMdZ72LYMFFMnxS1wTVcOLSvb:t47N9U/vmRT7Ck/dZ7BceS1McOLmb
                                                                                                                                                                                                MD5:9F7171D7377F96797D3AA80C2A82E49F
                                                                                                                                                                                                SHA1:E20980E2B3558839803623702CB63E594FD1EE48
                                                                                                                                                                                                SHA-256:D7718E518AF1A501D91B19F97DD5CD28740782852C3FB0BE5B5F1A6855C26F4F
                                                                                                                                                                                                SHA-512:9931C4904654C1BA487B71BB301FAC4C5F477845043B20A8705045FBAA3325A9907BCDF928B613B8B80B10E1D0AA81281473693066B056206C03C59FAD703932
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/search/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m20.87 20.17-5.59-5.59C16.35 13.35 17 11.75 17 10c0-3.87-3.13-7-7-7s-7 3.13-7 7 3.13 7 7 7c1.75 0 3.35-.65 4.58-1.71l5.59 5.59.7-.71zM10 16c-3.31 0-6-2.69-6-6s2.69-6 6-6 6 2.69 6 6-2.69 6-6 6z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 962

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):287
                                                                                                                                                                                                Entropy (8bit):4.942964715795682
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4z7yg0AiICpOTRKOFI38:t47N9U/vmRTDiI6mKOGM
                                                                                                                                                                                                MD5:1B72B0A3A3280DBE3DF3FB5DF68F90E7
                                                                                                                                                                                                SHA1:4F79E7A51FF1920839B106DC9848BB7BE3702445
                                                                                                                                                                                                SHA-256:781BA2DA6DA2698EE6727A646CC2B903A848EDCF729376419007185023E4A0F0
                                                                                                                                                                                                SHA-512:32257B5EE24DFCA90170D4AF48F2C3091EE83277F0F584B4CB46D4290BF6BF4FAE6FEB0D803D6A8B35EEE69E8F292EABE8C3632EAF782B07A8572D1C32BDCC2E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/lightbulb/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4-1.72-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 15.54 4 12.96 4 10c0-4.42 3.58-8 8-8s8 3.58 8 8z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 963

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):146
                                                                                                                                                                                                Entropy (8bit):4.938964132950675
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:tI9mc4slhohC/vmI4PKlGtNNUunJQ8i
                                                                                                                                                                                                MD5:0BB6E79FC4160D867A915A7D17A564FC
                                                                                                                                                                                                SHA1:E91CB173C9EEDDBFB2E61674DB09618A2479A053
                                                                                                                                                                                                SHA-256:DD08185E1339EA9B3EEA5B27FC3401E2171CE008523F8038B6B08681B4E05906
                                                                                                                                                                                                SHA-512:E1CB076164D3013612B36B41EAA43839A463C75104A85262CCC73B250ADEF1EC88D04D2A8F65D99D7EB89D4229022ECB4D3E370EE8BAC272426288A6F68C30F6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/bars_3/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 964

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):293
                                                                                                                                                                                                Entropy (8bit):4.8755880591325855
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4VJD2zPdqUQx+dfYLnIsy2RRWdxWqOQF:t47N9U/vmRf2bQxC6Is/7WdQqOQF
                                                                                                                                                                                                MD5:4881148D1D44126355C7CC134FD58441
                                                                                                                                                                                                SHA1:DF5775C8A3DA221FAD474807432534FA6CB5C1E5
                                                                                                                                                                                                SHA-256:57678BA3491574C18E14F5B0CF26215F1233BAACD2373A10A8F7C58A4D5DE65E
                                                                                                                                                                                                SHA-512:3CD013A210871E199F5BB68B10072BFA92FCB8648D3CFAB5D47889006ADE956D0F6FB9501AEF1326780EBA47B99F95023CDC0EEEB5093A1788EE9D730A5B64CB
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/audio/v5/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4V8h6V4h-7zM9 19c-1.66 0-3-1.34-3-3s1.34-3 3-3 3 1.34 3 3-1.34 3-3 3zm9-12h-5V5h5v2z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 965

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):3357
                                                                                                                                                                                                Entropy (8bit):7.8270924074413735
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:TNR1nsxrVYEfBX5LsqDUpnZHcbDP8eeReURVrytRxpZFQxbd07HUT2c1hwGh2hDV:TlsoEfBZQpntcbbbuyhpZFQtd7F2BV
                                                                                                                                                                                                MD5:DF02C29D56AD785F5F0E8D5015B323F6
                                                                                                                                                                                                SHA1:95FE814747FB38F416F4993439038ED250B767C4
                                                                                                                                                                                                SHA-256:1E486091E488CE2A3E07C6880BE99C649C1C184C895F4DCA754E5F2C225A8262
                                                                                                                                                                                                SHA-512:AAF833EFA282BF67CFDF2DFCCD3F061B256EC5AE8B8E0665751FBCCD344C7F916D03068637B8610221624F3B5B88C5A7FEBD0FEA95C0D709EE98753CB4B0154C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://yt3.ggpht.com/PLsX6LIg5JbMJR9v7eTD7nQOPmZN16_X7h_uACw5qeWLAewiNfasZFsxQ48Dn8wZ_4McKUPZSA=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D...........................................5............................!"1..Q.$24Au.q.#RUa.....................................?.........................!1.AQ.."2a.#q.46s..Bbr.....RS...................?....+...).).).).).).).).*.:..........I.9...2.>._8.$..Q..v..p...K.e!_. .$..Ru..l.7...!I...:|...*?.......j...........e_..F......./...k...U.B..........>.J..c._.......+..E....\.ZR......P..n.iN.I.$.3.}.6.......QP...........r...l...m.=<..Q......Y.....F..L.1...^.a....%Jl....w.v.......H.U.....,....N.c.Xz...H......aa.uvY.v@Pp.|S.B.....j..0.lr..!S.Q...{.......e.n..%....N.~..o.9R....|...x.T.vOd.t.}..JGx.8..R.>...7.....$gX...{.j..w..s...$.].N..Y......%.BI...t..RG#Z......zq&.A|..I,.p.......c.Gfs.Q..9d.2VV....lQ...L...g^.....I.m.1a.wB..QJ..J....@.d..t.......m......c*y!..v.....,+..8...E.^*.C.p...F@@..._.f.O8..

                                                                                                                                                                                                Chrome Cache Entry: 966

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (533)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):5547
                                                                                                                                                                                                Entropy (8bit):5.234104150395812
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:+E8YzVFXsVws8HYnkfI+C4yVdbaiGkNF2LSaAuEeRzgf5j6YJR79hamaWslv0Rw:+ajsVws8Hlzg2i/N9hzWgf5jhJR79haZ
                                                                                                                                                                                                MD5:936A7C8159737DF8DCE532F9EA4D38B4
                                                                                                                                                                                                SHA1:8834EA22EFF1BDFD35D2EF3F76D0E552E75E83C5
                                                                                                                                                                                                SHA-256:3EA95AF77E18116ED0E8B52BB2C0794D1259150671E02994AC2A8845BD1AD5B9
                                                                                                                                                                                                SHA-512:54471260A278D5E740782524392249427366C56B288C302C73D643A24C96D99A487507FBE1C47E050A52144713DFEB64CD37BC6359F443CE5F8FEB1A2856A70A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/intersection-observer.min.vflset/intersection-observer.min.js
                                                                                                                                                                                                Preview:/*.. Copyright 2016 Google Inc. All Rights Reserved... Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE... https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document..*/.(function(f,h){function t(a){this.time=a.time;this.target=a.target;this.rootBounds=a.rootBounds;this.boundingClientRect=a.boundingClientRect;this.intersectionRect=a.intersectionRect||q();this.isIntersecting=!!a.intersectionRect;a=this.boundingClientRect;a=a.width*a.height;var b=this.intersectionRect;b=b.width*b.height;this.intersectionRatio=a?b/a:this.isIntersecting?1:0}function d(a,b){b=b||{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");.this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMargin);this.thresholds=this.J(b.threshold);this.root=b.root||null;this.rootMargin=this.s.map(function(c){return c.value+c.unit}).join(" ")}function y(a,b){var c=null;return function

                                                                                                                                                                                                Chrome Cache Entry: 967

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):38674
                                                                                                                                                                                                Entropy (8bit):5.373344735979869
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:AOZQqlnxITA3+sypwDMBub/6rur81gE0idWSBiHLztbyHgNkmtCgs+FwtNmle:efY+3g/br8qaWSBiHLRGHEbtCgKJ
                                                                                                                                                                                                MD5:9FB0BDB3A292F495914A785280685816
                                                                                                                                                                                                SHA1:2FBAC1566F42B41D336C3CEF46085A8ABA5291F4
                                                                                                                                                                                                SHA-256:8B94EC92B902A78BB5DCF8A9A5CF00B3F693738608FE110FF77A2E90FA62AA09
                                                                                                                                                                                                SHA-512:94E76518978E828E0EAA8B95C807E55DBF4E0EBA201FF5057906482AD5F57D2D2A6BA98F0EE16476688E3B5013525D06EAED692C6B795DAAE635F67B8CD100F7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.moa=function(a){var b=0,c;for(c in a)b++;return b};_.noa=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ka(a)||"string"===typeof a?a.length:_.moa(a)};_.vn=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ka(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.ooa=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ka(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.zb(a)}}};.var poa,soa,roa,qoa,Ln,Nn,Eoa,voa,xoa,woa,Aoa,yoa;poa=function(a,b,c){if(b)re

                                                                                                                                                                                                Chrome Cache Entry: 968

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):216
                                                                                                                                                                                                Entropy (8bit):4.800786010781648
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4TK4G2aCM0xt0WGSSJhEi:t4noU/vmRTKd2aCJiWGXEi
                                                                                                                                                                                                MD5:4769BF33E9F7764A9E55468B4B2FDD43
                                                                                                                                                                                                SHA1:018175AA909257C549153A1488B9C7FFFDEDA23E
                                                                                                                                                                                                SHA-256:53A433282E4E3F47144F41EAA4143F35763DB4616DF7791008A1AF78D32C975A
                                                                                                                                                                                                SHA-512:C78FA4DF431A81B903586FCA21B3315E781AE374B1443147EDAE2F961CBEB4A021F2BF363F39516380D596C3C448B9350D8FCE8A3A2C2CC1B28ED0FF11D26FCD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/clock/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm2.97 14.95L10 13.87V7h2v5.76l4.03 2.49-1.06 1.7z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 969

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):398
                                                                                                                                                                                                Entropy (8bit):4.820547366953078
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRTDiI6mKOG7bTJ1XUfCRimfDqQehW:t4jU/v0rdGHTJCfCw+qi
                                                                                                                                                                                                MD5:2A0EC6EB2D5A6F6DEF85A2B9A667C42F
                                                                                                                                                                                                SHA1:08BA82555D8CA056757BEAC3F8B443A1F60C6061
                                                                                                                                                                                                SHA-256:85357D329507B0542A21870A328E20F77E6E991BC97D86EC0ACD2521A3C12332
                                                                                                                                                                                                SHA-512:60AD37CE0204D2F8C60E8F91405E97913E6481E09B4AFF28809573420B988E5AEAB5D77E6B55C8CFAE38D2EA0B228AE7A2EF2CF47FD2B461996B894834BFE9C9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/lightbulb/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4-1.72-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 15.54 4 12.96 4 10c0-4.42 3.58-8 8-8s8 3.58 8 8zm-5 8v-1.66l.5-.29C17.66 14.8 19 12.48 19 10c0-3.86-3.14-7-7-7s-7 3.14-7 7c0 2.48 1.34 4.8 3.5 6.06l.5.28V18h6z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 970

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1612
                                                                                                                                                                                                Entropy (8bit):7.010027226817285
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gqThv/qLc1spGaKdkwKnVHzFN9TV/webvZ9yCZSkjqIPlou1XQYFtTM:gy/EiWGaKMJJ3V/HeC3PC0Xr4
                                                                                                                                                                                                MD5:5D900D0F6912562E5A8B771683D2C1C5
                                                                                                                                                                                                SHA1:66F4C4A60597622513512E548ADB8C9B16E76E87
                                                                                                                                                                                                SHA-256:625BE4F817DCECA60FBED5B981B32048B77BB9538E2AA916C7C12297F905489F
                                                                                                                                                                                                SHA-512:E104D56F6A5B8221D2484B97E06B8C568E217F0A76A76E5434E8F20E96A9EEC69EBDFF506EDC1045307C761C654EE5B88DCC806CEE1CD3076A722ADC638A582B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/369677746_2234156393461259_3060373443569516943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=hWppMXL0k0gAX93dcB2&_nc_ht=scontent-lga3-2.xx&oh=00_AfDULH29FaRB3-Fb2gNsZGn8OSFS95YiFIZB10QuJMbRPg&oe=65D3343E
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e601000085020000c102000006030000bf03000073040000aa040000e5040000290500004c060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...............................................................................'..t...a......Z..K.s.F.....).psq.\bV..b...?..).sJ.Aj.x#}....O...%...........................!" #$23B............h...-......e.:F...Y...R.YF%..A.u..ImU...WB/........r...M.J...[...QQ.......W.^&czE......^;....?..w.e.TD./+..............................A!1Q........?.c3Nb...v.q................................!..AQ........?.[..X..{Q...Q.d(...)........................!1AQ..a Bq"2Rr.........?....h..\..s..E.f....Z.Pw".:....-.....Y..x3..'h.Uj.T....]KJSj...J.).cH.........8|'H.6&;..F1S>s...L.|.Q.eO.....(....<....iV'>`...'ke..w....!....................!1AQ.q..a..........?!...V......Pa.& .j..x.....9$.{

                                                                                                                                                                                                Chrome Cache Entry: 971

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (645)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):11085
                                                                                                                                                                                                Entropy (8bit):5.397976873792712
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:8losmj1Uqu+oCNLuZ08MnpAqntHMfG0v8X6JPRAkZE:JUEoCNLDpN8G0vDn9K
                                                                                                                                                                                                MD5:CE762A9D30D6C70BB0516E8CEFC958BF
                                                                                                                                                                                                SHA1:DA6CAC9C717DAA3A39F82F3421782C99EDD9329D
                                                                                                                                                                                                SHA-256:A9FC343D602527A427E57671D021524A9FF5AF7B3DF1A58900A3B01057BDD8C7
                                                                                                                                                                                                SHA-512:230753FBB26E90438DD43874D02FBBB1AD6DB9A0FE76DA978EA47A8CA06FC99DD5E475104ABB5DD25CE222423D9BDA7991FD0EE896386561CD6F9AC10F8932E2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/jsbin/www-tampering.vflset/www-tampering.js
                                                                                                                                                                                                Preview:(function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function q(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var r=q(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(l){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(e+(l||"")+"_"+h++,l)}.function c(l,m){this.g=l;p(this,"description",{configurable:!0,writable:!0,value:m})}.if(a)

                                                                                                                                                                                                Chrome Cache Entry: 972

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (14338)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):660889
                                                                                                                                                                                                Entropy (8bit):5.486581037086205
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:/3QpRABxT7AcEKpY85oEzS7hLPGMZQwjVktI9xAe/eaRm5q:PWAzWEIjVktDc5
                                                                                                                                                                                                MD5:B902F5352E4F7432AA3679F4D3683DB7
                                                                                                                                                                                                SHA1:E2651B2E7D0CD1CB4B7C06327B7473551BE289FC
                                                                                                                                                                                                SHA-256:D75EBE4AC52B0A814EAE7B66F1A986CCF8B55915D8CB9F74AE5662548B8BD526
                                                                                                                                                                                                SHA-512:48DCD87586D3C532EBEED9F256F863B1331A06AD1C34BABECFE05914DA69DFC18B7AB463187ABD56C22C3867DAC1E0AF14051A28BCFA1CF57AE2EEB4B7F5B072
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iJMB4/yk/l/en_US/kLR5Q0pPIzZlqlG_ZmER5OllKu4g4IMojgPlH604MHyzdPiShQ9a7xP49wuqFC0MPXQzOjQ18M7Ra8sPFi6VZcj7OuDENWdRgBuo6uJQqqrz6z1Rdzuzi16ygGc1wa-Oq19cevyCvEVQbD2OmPobANp9KHpDnYRWx5vjUlU_6SmVEaVrlFSHhTt9z8sgFRlCsGN0FHwCFoDf7C27gzi95_wmB-51YxoStyBz2gEaogygfp_uoh2pEQn4HVER6y-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("SecuredActionChallengeCDSPasswordDialogQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6074231989279806"}),null);.__d("SecuredActionChallengeCDSPasswordDialogQuery$Parameters",["SecuredActionChallengeCDSPasswordDialogQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("SecuredActionChallengeCDSPasswordDialogQuery_facebookRelayOperation"),metadata:{},name:"SecuredActionChallengeCDSPasswordDialogQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("SecuredActionChallengePasswordDialogQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7156984220988024"}),null);.__d("SecuredActionChallengePasswordDialogQuery$Parameters",["SecuredActionChallengePasswordDialogQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("SecuredActionChallengePasswordDialogQuery_facebookRelayOperation"),metadata:{},name

                                                                                                                                                                                                Chrome Cache Entry: 973

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (562)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):151037
                                                                                                                                                                                                Entropy (8bit):5.6331112458386565
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:1VNOSOAG4zLMfdxFkQIkvA0xoMlCFpM5ws:vHNQfdxFkjkvA0xocCFpMf
                                                                                                                                                                                                MD5:3D6122041360052D41A6650330F78A74
                                                                                                                                                                                                SHA1:B540DC32BF68922D22A9A8DAA5BC521FCC9E3B2F
                                                                                                                                                                                                SHA-256:47090D76066413CFFCAFB50EEC7DFD79BBBD75EC46C03CCD303DBB67A0EA839F
                                                                                                                                                                                                SHA-512:E215AB5B85AECE1557E35A81FE6F807295BAB7EE823BC795B17B82C54FE603AEFAEE368380A6CA7AF055A949FCBB9A1F02C03432E9AF5CF5EB5B3F51B21551F1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/offline.js
                                                                                                                                                                                                Preview:(function(g){var window=this;'use strict';var btb=function(a,b){var c=[];return g.MD(a,{query:b},function(d){c.push(d.getValue());return d.continue()}).then(function(){return c})},ctb=function(a,b){return"getAll"in IDBIndex.prototype?g.AD(a.j.getAll(b,void 0)):btb(a,b)},dtb=function(a,b){return g.FD(a,["captions"],{mode:"readonly",.Tb:!0},function(c){return g.Xqa(c.objectStore("captions"),b)})},etb=function(a){var b=new g.EP("und",new g.kR("Default","und",!0));.b.captionTracks=a.captionTracks;return b},ftb=function(a){return new g.dg(function(b,c){var d=a.length,e=[];.if(d)for(var f=function(n,p){d--;e[n]=p;0==d&&b(e)},h=function(n){c(n)},l=0,m;l<a.length;l++)m=a[l],g.hca(m,g.kb(f,l),h);.else b(e)})},O6=function(a){this.j=a},P6=function(){O6.apply(this,arguments)},gtb=function(){P6.apply(this,arguments)},htb=function(){P6.apply(this,arguments)},itb=function(){P6.apply(this,arguments)},jtb=function(){O6.apply(this,arguments)},ktb=function(){P6.apply(this,arguments)},ltb=function(){P6.ap

                                                                                                                                                                                                Chrome Cache Entry: 974

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1971
                                                                                                                                                                                                Entropy (8bit):4.140265923170004
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:48:4uxgftjRvYQn94Cz5pdVw8jV/cu745MJzis0rR+ToGq/SJKF:aR5pPvtc2fd0YT+
                                                                                                                                                                                                MD5:8F64411A9AC7F40E18967F620AE1B546
                                                                                                                                                                                                SHA1:4C3FCE32CE99FAACEA1BADF35BE7091BD2F09384
                                                                                                                                                                                                SHA-256:B77B4C9A17FB16DDADEC307F40FE8B37F806D80E97E3F8854142CDA91662708B
                                                                                                                                                                                                SHA-512:3DE4780539E5C9850987401436A8F5D16177393C1AF930B01B7E9987CE2CB875ABD2490116DE0B6597C2A1B0D0D11E7AC872B652E5D8EF3B84C23146FAA0FA16
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_kids_round/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M21.39,13.19c0-0.08,0-0.15,0-0.22c-0.01-0.86-0.5-5-0.78-5.74c-0.32-0.85-0.76-1.5-1.31-1.91 c-0.9-0.67-1.66-0.82-2.6-0.84l-0.02,0c-0.4,0-3.01,0.32-5.2,0.62C9.28,5.4,6.53,5.8,5.88,6.04c-0.9,0.33-1.62,0.77-2.19,1.33 c-1.05,1.04-1.18,2.11-1.04,3.51c0.1,1.09,0.69,5.37,1.02,6.35c0.45,1.32,1.33,2.12,2.47,2.24c0.28,0.03,0.55,0.05,0.82,0.05 c1,0,1.8-0.21,2.72-0.46c1.45-0.39,3.25-0.87,6.97-0.87l0.09,0h0.02c0.91,0,3.14-0.2,4.16-2.07C21.44,15.12,21.41,13.91,21.39,13.19 z"></path>. <path fill="#000" d="M21.99,13.26c0-0.08,0-0.16-0.01-0.24c-0.01-0.92-0.54-5.32-0.83-6.11c-0.34-0.91-0.81-1.59-1.4-2.03 C18.81,4.17,17.99,4.02,17,4l-0.02,0c-0.43,0-3.21,0.34-5.54,0.66c-2.33,0.32-5.25,0.75-5.95,1C4.53,6.01,3.76,6.48,3.16,7.08 c-1.12,1.1-1.25,2.25-1.11,3.74c0.11,1.16,0.73,5.71,1.08,6.75c0.48,1.41,1.41,2.25,2.63,2.38C6.06,19.98,6.34,20,6.63,20 c1.07,0,1.91-0.23,2.89-0.49c1.54-0.41,3.46-0.93,7.41-0.93l0.1,0h0.02c0.97,0,3.34-0.21,4.42-2.2 C22.

                                                                                                                                                                                                Chrome Cache Entry: 975

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                Entropy (8bit):4.705262579447954
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRviScJUkRUWJDUU1V0QLEjz5UFDUl:tI9mc4slhohC/vmVR6SWJDNejF2il
                                                                                                                                                                                                MD5:28B7D5722D774748EB3BEE51D246A9A8
                                                                                                                                                                                                SHA1:B61B3FA044EA865243E2FF195A81AF1027A9F152
                                                                                                                                                                                                SHA-256:9B70EAE3BBA1AFC60819D43E37AF558FAB2D1C429DD940DCAB4B35E23BD51989
                                                                                                                                                                                                SHA-512:9E8D26D7EA3B6ED05348EB75555FDCB001AECC24AB8516AE8058C3B7FA6B791CAB056A31FBEAFEC18C9E97FB39657B07EA7ABE3E3347B9C9D86FC18AF4943796
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/arrow_down/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.79,11.29 13,17.09 13,4 11,4 11,17.09 5.21,11.29 3.79,12.71 12,20.91 20.21,12.71"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 976

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (7990)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):465292
                                                                                                                                                                                                Entropy (8bit):5.569457294926429
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:LQELY2kiAGix0KDCJcrjrMwmvsPJ80cFdelRDKRsHuHaR9stEc7S/i18E/JZGwS4:XxTelhks79sac7S618OZGxrpsU6FrvBr
                                                                                                                                                                                                MD5:EC3D2A1902B8EE370ABBFA70FD58E999
                                                                                                                                                                                                SHA1:BF6A5A23ECF9596FA695FE85C943C38F700F2795
                                                                                                                                                                                                SHA-256:E72B31BF376DFD45DE76AE07148C7794E03ED23690C491A8357BEEF413F7206B
                                                                                                                                                                                                SHA-512:28D7F573CD70DEC7D7569657224D33E8EC4BFF7BADA4DFFFC574A805856E68ADB45BC08F257DEE79CBE8816FC3D5D6BC32946945F2E780851C1E5AF6B73BE595
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ifrz4/yc/l/en_US/zY63U5CD65W.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometBatchNotificationsStateChangeSubscription_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6546596222061607"}),null);.__d("CometBatchNotificationsStateChangeSubscription.graphql",["CometBatchNotificationsStateChangeSubscription_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a={defaultValue:null,kind:"LocalArgument",name:"environment"},c={defaultValue:null,kind:"LocalArgument",name:"input"},d=[{alias:null,args:[{kind:"Variable",name:"data",variableName:"input"}],concreteType:"BatchNotificationStateChangeSubscribeResponsePayload",kind:"LinkedField",name:"batch_notification_state_change_subscribe",plural:!1,selections:[{alias:null,args:null,concreteType:"Notification",kind:"LinkedField",name:"aggregated_notifications",plural:!0,selections:[{alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"seen_state",storageKey:null}],storageKey:null},{alias:null,args:nu

                                                                                                                                                                                                Chrome Cache Entry: 977

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):12647
                                                                                                                                                                                                Entropy (8bit):7.937868260143406
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:192:eic/NgNreoEGyaC0v1KKFhETOUteRG/0x1Ux9hgezGvQENoyQP0pr4lIlgunuR:hONZSKKFhEX88/uel0VQP0prAIlgrR
                                                                                                                                                                                                MD5:6D6374739230F5B23B06E02F784C2559
                                                                                                                                                                                                SHA1:7FFF6A633B014BCF6F9846358E12693C08C7A8C4
                                                                                                                                                                                                SHA-256:7EC72FB96102B8E1F4D2358CA4649C8124D8172723326FEBFCF9D8197E3E73C9
                                                                                                                                                                                                SHA-512:149DB9FE590D0E1A6E134904FB0E513E4098BC904632833E8F8543633BF6517E532CB40C91C06ECECDEA7EEAB125448E3B2E7CECB6E002ED12A33D066C57215A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426400678_3516705878640007_1887720583191051747_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=Hl5fzeSeVXYAX-1WUj2&_nc_ht=scontent-lga3-2.xx&oh=00_AfAWi5HOE3skTduafLvHiIQ012IkAFp_uaNCddIbze4TQg&oe=65D2FD26
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7001000054060000830c0000de0d00001e0f0000a0140000d61d0000ea1e000081200000fd21000067310000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................;uyi$...]P2t..bI.g`f..:.8Fl.t.Q.u...@s..:y.=.....h..A...........&s.05.d...K.^.W...k.s..3]W/vx.<..4.)......AM.b..+V .X..*&.gl0t..9.3..us...R..E.].R.....u.'.'@.$..vE.#.i..od`..k...9...v.zr7M..Wn.1.M.(....X.e6YT.%'L.; t.=....3..>..M.8z..........._...?...q..ci..&RgH.:.I...m\.A..<...r.=....M...F...#3....8e..Hc..9(L.d.$..I.|......)b...vE.w..ct<.P.=;.j...`.z...*.....Pt..I.I......{)...fN.....|...}9..p'.^.9.jYz..QM.hN..e(.RI L...]....F...R.7>.h:9{1m.;Th..j...w{..3.1VT2...2..BvH.@...J....U[KX.].M.l..Zq..<.@.........F>F..{+....0..4'h.I.3.G...xWmp.y......E.b..].....{.*0..l..}.e.E..h.w....

                                                                                                                                                                                                Chrome Cache Entry: 978

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (776)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1480
                                                                                                                                                                                                Entropy (8bit):5.278661843249328
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:kMYD7xb4Uu0UIqraN3OYfl/HTn93EyNPrIH6iQG7ALbDs3dEGbwc0GbgjUTOuhZg:o7xbm09Awn9Es66nG7API3dEGbwc0Gb0
                                                                                                                                                                                                MD5:B1E42198FB893A628628BCFDB3667B1F
                                                                                                                                                                                                SHA1:A115D5B91E02912CC6099FFD6B6F5CBCE6F19EC7
                                                                                                                                                                                                SHA-256:263E701257ED8F7A63E265CF0F906020AF51E8552732D23F11276DB5428B08DD
                                                                                                                                                                                                SHA-512:EC2AE05CCF97D6F21268ADA5C21F90D6BCD0F6F8E9E7E3D5264A866589673BB3EE88B2724209BC4D608B7BCE2EDDCCCE8DBCAA2AA8B30F265FDC4D0CEDD79566
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("kMFpHd");._.lUa=new _.qk(_.Qk);._.l();._.k("bm51tf");.var oUa=!!(_.Kda[0]>>18&1);var qUa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=pUa(this)},rUa=function(a){var b={};_.Na(a.tN(),function(e){b[e]=!0});var c=a.gN(),d=a.mN();return new qUa(a.WJ(),1E3*c.aa(),a.EM(),1E3*d.aa(),b)},pUa=function(a){return Math.random()*Math.min(a.ta*Math.pow(a.ja,a.aa),a.Ca)},qE=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var rE=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.vQ;this.ja=a.Ea.metadata;a=a.Ea.F$;this.da=a.ea.bind(a)};_.B(rE,_.I);rE.Oa=_.I.Oa;rE.Ba=function(){return{Ea:{vQ:_.mUa,metadata:_.lUa,F$:_.fUa}}};rE.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Bd()))return _.al(a);var c=this.ea.aa;return(c=c?rUa(c):null)&&qE(c)?_.Csa(a,sUa(this,a,b,c)):_.al(a)};.var sUa=function(a,b,c,d){return c.then(function(e){

                                                                                                                                                                                                Chrome Cache Entry: 979

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):531
                                                                                                                                                                                                Entropy (8bit):4.517890434004929
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4tM65EVlUbal0YClBze4gKCqRaMcmt+BOgyy9e5PhwWU:t4tMMbS0TBAMdc1QgcdrU
                                                                                                                                                                                                MD5:D8AB2A29ED285F79AF11A250D2536BC1
                                                                                                                                                                                                SHA1:B394B72270ECA95336C5780E1F97C0CAD051C0FF
                                                                                                                                                                                                SHA-256:AAAEF8F774A256E546C1178D91EBBA27FA0F7A7420D7E54DCC4F26D6DD7AB31A
                                                                                                                                                                                                SHA-512:3F376435B591FCB848D4D259A0DA5BAE15EB8583572C00C6E3041DDB64C1756E48A333EB6144042A45D23E2A45DB623CD78DB5467579051CA674F93C8964FCE2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-comment/v2/32px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.5 3C4.11929 3 3 4.11929 3 5.5V21.5C3 22.8807 4.11929 24 5.5 24H22.5L26.7474 28.5741C27.5513 29.4399 29 28.871 29 27.6895V24V5.5C29 4.11929 27.8807 3 26.5 3H5.5ZM8 10.5C8 9.67157 8.67157 9 9.5 9H22.5C23.3284 9 24 9.67157 24 10.5C24 11.3284 23.3284 12 22.5 12H9.5C8.67157 12 8 11.3284 8 10.5ZM8 16.5C8 15.6716 8.67157 15 9.5 15H18.5C19.3284 15 20 15.6716 20 16.5C20 17.3284 19.3284 18 18.5 18H9.5C8.67157 18 8 17.3284 8 16.5Z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 980

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                Entropy (8bit):5.110752654085156
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHAquqFbV9jXReHFAATcvXjXRHRcBHoNcHVaocoaQgeFOK/:tI9mc4slhohgqWHiA4vmI4VPgq
                                                                                                                                                                                                MD5:590C4B291CE0B9AD72E436BD0777D562
                                                                                                                                                                                                SHA1:974DC251B395357A38A0EC06CB87C28F70A23CB1
                                                                                                                                                                                                SHA-256:F40804CDE31FC6CE2B19B2E4DE7189916146031A5D7958B4512D30751B767D00
                                                                                                                                                                                                SHA-512:5DE6F1C10AF2C9EAD02B9DCA07FC4B23E0B34872CB1904FE2EED57BD2C4739CAC0A5FEE24401B457F146F5A6D43DE807E1D44DD4D33AA3B8BBA33B107428AF77
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/play_arrow/v7/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M9 5.87 18.2 12 9 18.13V5.87M8 4v16l12-8L8 4z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 981

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                Entropy (8bit):5.1052862366626295
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHEkRY4zf9UJtTzWNRI:tI9mc4slhLJ9hC/vmI4zRqj/CIIHZY
                                                                                                                                                                                                MD5:326BF908127D15320C80C12962A91DCD
                                                                                                                                                                                                SHA1:D346CFA4AE456C3E070206472F06E90A9DAA8C25
                                                                                                                                                                                                SHA-256:97DC7B49E38E2084B1877557AF54EBA95BF7FAF06980E0DCCDCA2EAD81E35B60
                                                                                                                                                                                                SHA-512:E4835907B72B75C09F32416911A4B3535791B54C6BDD0BFA9C0A48399A8E4930CDBD0B32FD13A67002F49F99199FBE358D5B4B89E4609C837E73799FF0D46F08
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/library/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M4 20h14v1H3V6h1v14zM21 3v15H6V3h15zm-4 7.5L11 7v7l6-3.5z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 982

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):207
                                                                                                                                                                                                Entropy (8bit):5.099700989024115
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4u2U6PTkY5fUgNOJNu:t47N9U/vmR0kTkYZUg2M
                                                                                                                                                                                                MD5:D9BB191D7185DB63EC946298DE7F9AF9
                                                                                                                                                                                                SHA1:CDE1E715177A55F8F7C9CE0BB1766481EF215D8A
                                                                                                                                                                                                SHA-256:40829C1F6F101B7122AB0D9EDC7A4EDB6368448259A74831C2FAD26D865DD90F
                                                                                                                                                                                                SHA-512:7B8B57273161CA8EC550E7C04AAFA34A8C48CE66FBFB5123C48F84AE4A5C9B43C5820EC5D00E62B12D3AFF946ACCC4F1501132FDB034A9E39F83B18E6A7CDAB0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/library/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m11 7 6 3.5-6 3.5V7zm7 13H4V6H3v15h15v-1zm3-2H6V3h15v15zM7 17h13V4H7v13z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 983

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):47505
                                                                                                                                                                                                Entropy (8bit):7.978008873883618
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:768:mpyv3tio8Oy9AUSyt3Fdj2oH720n3J/cN0AwlGF0ryeqjyVhDKgjuUMl3M:HEo8Q+Hr0xxFgMmKgSUMS
                                                                                                                                                                                                MD5:E3D59943F076FDD6A44AD9BADADDF26A
                                                                                                                                                                                                SHA1:9896CA3C3F82E8837C6E17CF75575CA152A7C2AD
                                                                                                                                                                                                SHA-256:AE6F930C7FED9C783329948EB6F109259839CBF0D6208E91ACAFA9FB63A20B7A
                                                                                                                                                                                                SHA-512:BC7F70AEA4981061F53A6888EC1DDCAC0FA0A96C9DE3DB6DCB054A40276334BFD2CE5434B64706EC4C5EA03B576058A4E9563215E932B40C4A9EBBC2ACB8362B
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426464083_237367422763005_2737690849384919503_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=1S5QQnYThhoAX9ZzIXf&_nc_ht=scontent-lga3-2.xx&oh=00_AfATyLfbKQhIgViUy1a-3iLI0RUzFlswADXC8EO0N55vvQ&oe=65D457DB
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000371c0000fd380000903b0000233e0000994800002a6c0000607200009e760000137b000091b90000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................`..g$'NYAv..UInT........+...V...F.Q$.$..U....j-OQr.....$3p.'$....T...$*HJ.J.I!$.wDY.GSI...=.t.q.....*.I.kd]..D%.........r.=.$..aK..u.uuR.%]......K.eK.K...UtA..\*J.T. .u..m...W[...@.....*.qF...#....,..r.Z.cw!..H.`\...$...%I.R.%..%..H.....T.I...K.I..@...5.......Ph...$..Kv2,.a..5.I...."e.59...>.1(..^.%]...65r.]J.U.H\.U...X..J.R.$$..7e....u.+.x. .PL1..f.Rj.L.bL2]..K!.K.n]Y%..gW$.-.v......CL^.7@.IIpl..]..BE.E.TJ.*..WEI.We].d$.tG.G:.s...=....r....%a.9\y..........j.:.*^~.tOB.;.:..BY.P.WEI..BI..2..]... ^.a......w...X....Mu.zO.....d<...,.i,..K9.edk~&..Z.&.4....]5.......M..a.PtparBI"I

                                                                                                                                                                                                Chrome Cache Entry: 984

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):4119
                                                                                                                                                                                                Entropy (8bit):5.363860210804462
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:GkBsIzf6Aj6TQTdkvEc2K7UrtNoyd+ypYokBnz8oLw:3BHzn+Wm97UToyd+ypYokDc
                                                                                                                                                                                                MD5:B60A1BABBA7EDBA6C5A9FC4836A079C6
                                                                                                                                                                                                SHA1:082278E6B6E8A2F53237EE992E77FE45F8764957
                                                                                                                                                                                                SHA-256:A925BAF5E1E6227CE778335AE876AD0B2C0A46AF791E2FE0BE7D9548015BBD82
                                                                                                                                                                                                SHA-512:975738EE48432A77B3423E4BE71EE3FAEF65CF03EFA95A786357438132ECE6942ACF1163DB3A1513515A8617807D5C21DA44CB510E32DCA941927F5C369388B9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                                                Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.uf(_.hna);._.k("sOXFj");.var Rq=function(a){_.I.call(this,a.Ha)};_.B(Rq,_.I);Rq.Oa=_.I.Oa;Rq.Ba=_.I.Ba;Rq.prototype.aa=function(a){return a()};_.Lq(_.gna,Rq);._.l();._.k("oGtAuc");._.Gsa=new _.qk(_.hna);._.l();._.k("q0xTif");.var Cta=function(a){var b=function(d){_.bm(d)&&(_.bm(d).uc=null,_.er(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},qr=function(a){_.np.call(this,a.Ha);this.Ra=this.dom=null;if(this.Zh()){var b=_.sk(this.Cf(),[_.Uk,_.Tk]);b=_.wh([b[_.Uk],b[_.Tk]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.Dq(this,b)}this.Ma=a.nh.U7};_.B(qr,_.np);qr.Ba=function(){return{nh:{U7:function(){return _.ff(this)}}}};qr.prototype.getContext=function(a){return this.Ma.getContext(a)};.qr.prototype.getData=function(a){return this.Ma.getData(a)};qr.protot

                                                                                                                                                                                                Chrome Cache Entry: 985

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (776)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1480
                                                                                                                                                                                                Entropy (8bit):5.278661843249328
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:kMYD7xb4Uu0UIqraN3OYfl/HTn93EyNPrIH6iQG7ALbDs3dEGbwc0GbgjUTOuhZg:o7xbm09Awn9Es66nG7API3dEGbwc0Gb0
                                                                                                                                                                                                MD5:B1E42198FB893A628628BCFDB3667B1F
                                                                                                                                                                                                SHA1:A115D5B91E02912CC6099FFD6B6F5CBCE6F19EC7
                                                                                                                                                                                                SHA-256:263E701257ED8F7A63E265CF0F906020AF51E8552732D23F11276DB5428B08DD
                                                                                                                                                                                                SHA-512:EC2AE05CCF97D6F21268ADA5C21F90D6BCD0F6F8E9E7E3D5264A866589673BB3EE88B2724209BC4D608B7BCE2EDDCCCE8DBCAA2AA8B30F265FDC4D0CEDD79566
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("kMFpHd");._.lUa=new _.qk(_.Qk);._.l();._.k("bm51tf");.var oUa=!!(_.Kda[0]>>18&1);var qUa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=pUa(this)},rUa=function(a){var b={};_.Na(a.tN(),function(e){b[e]=!0});var c=a.gN(),d=a.mN();return new qUa(a.WJ(),1E3*c.aa(),a.EM(),1E3*d.aa(),b)},pUa=function(a){return Math.random()*Math.min(a.ta*Math.pow(a.ja,a.aa),a.Ca)},qE=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var rE=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.vQ;this.ja=a.Ea.metadata;a=a.Ea.F$;this.da=a.ea.bind(a)};_.B(rE,_.I);rE.Oa=_.I.Oa;rE.Ba=function(){return{Ea:{vQ:_.mUa,metadata:_.lUa,F$:_.fUa}}};rE.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Bd()))return _.al(a);var c=this.ea.aa;return(c=c?rUa(c):null)&&qE(c)?_.Csa(a,sUa(this,a,b,c)):_.al(a)};.var sUa=function(a,b,c,d){return c.then(function(e){

                                                                                                                                                                                                Chrome Cache Entry: 986

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (546)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):72824
                                                                                                                                                                                                Entropy (8bit):5.578123343287293
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:4Ev23HqCFkPDh3n6AJRMmkhlDeosFykpvU:b23KjJ39khpbqs
                                                                                                                                                                                                MD5:DB094636C3674054499112D546362060
                                                                                                                                                                                                SHA1:A7DBFEAB8B676A4E577290318EF9475BC3027360
                                                                                                                                                                                                SHA-256:EE163AA3AA3E9F1D1A1FE9CA78785945DDD7CE284FF08B97A17F3A46CBC89BA0
                                                                                                                                                                                                SHA-512:D234889643390D71AEFD48ED3724733E0092606BB3AE87599929E236DDF14BDE17645D023CFF95142C94A95CAAF10CF19FCCE0AAE6287736C447994CF04629A5
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/captions.js
                                                                                                                                                                                                Preview:(function(g){var window=this;'use strict';var Inb=function(a,b){return b?a.captionsInitialState:"CAPTIONS_INITIAL_STATE_UNKNOWN"},Jnb=function(a,b){var c=new g.IS;.c.languageCode=a.languageCode;c.languageName=a.languageName;c.name=a.name;c.displayName=a.displayName;c.kind=a.kind;c.isDefault=!1;c.j=a.j;c.isTranslateable=a.isTranslateable;c.vssId=a.vssId;c.url=a.url;c.translationLanguage=b;a.xtags&&(c.xtags=a.xtags);a.captionId&&(c.captionId=a.captionId);return c},Knb=function(a,b){var c,d,e;.return g.H(function(f){if(1==f.j)return c=a+"|"+b,g.z(f,g.UD(),2);if(3!=f.j){d=f.B;if(!d)throw g.xD("gct");return g.z(f,g.XS(d),3)}e=f.B;return f.return(e.get("captions",c))})},Lnb=function(a,b,c){Knb(a,b).then(function(d){d&&c(d.trackData,new g.IS(d.metadata))})},Onb=function(a){if(!Mnb.test(a))throw Error("'"+a+"' is not a valid hex color");.4==a.length&&(a=a.replace(Nnb,"#$1$1$2$2$3$3"));a=a.toLowerCase();a=parseInt(a.slice(1),16);return[a>>16,a>>8&255,a&255]},Pnb=function(){return g.VC("yt-playe

                                                                                                                                                                                                Chrome Cache Entry: 987

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):726
                                                                                                                                                                                                Entropy (8bit):4.339020219837034
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t4tM65hacbIQEJzqgnuTx9DcwBCkrcE+DDuqE3kjZRpQNtdhlwcf9iSBcG7BihbX:t4tMMt9EgFEFu+eq7fpQNtdMcf9iSqku
                                                                                                                                                                                                MD5:1B8EC16A3060F8866E64FCDC09FF7185
                                                                                                                                                                                                SHA1:B5E017E0D46F2DB0FC18A5E74F740D69FEED0372
                                                                                                                                                                                                SHA-256:4E4AAE10A6FD5B8F86E1565507983459C3D0F474313547C9DAB176F83261A523
                                                                                                                                                                                                SHA-512:07CD2A5466B397E612EB7A9827646BF0606031ECAE1771DCD93360BFF0F14477ABCD0F70B215C21879C9C5BA5E64BA9114CB036D7D401BE873DE1F84CC40B888
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-like/v2/32px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M25.8411 11.9977C26.6778 11.9977 27.4597 12.414 27.9268 13.1082C28.6951 14.2498 28.6876 15.745 27.908 16.8789L27.1796 17.9383L27.8546 19.5037C28.257 20.4368 28.1597 21.5102 27.596 22.3558L26.4999 24V25.9977C26.4999 27.1023 25.6044 27.9977 24.4999 27.9977L11.9999 27.9976C10.8953 27.9976 9.99987 27.1022 9.99987 25.9976V12.8264C9.99987 11.9927 10.2604 11.1799 10.7449 10.5015L15.8632 3.33586C16.0776 3.03569 16.4721 2.92531 16.8112 3.07062C18.5762 3.82706 19.5347 5.74955 19.0766 7.6144L17.9999 11.9976L25.8411 11.9977ZM5 13.4999C3.89543 13.4999 3 14.3954 3 15.4999V25.9999C3 27.1045 3.89543 27.9999 5 27.9999H8V13.4999H5Z"></path></svg>.

                                                                                                                                                                                                Chrome Cache Entry: 988

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                Entropy (8bit):4.979692330240301
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHELK9hrqgrNI2fSb8:tI9mc4slhLJ9hC/vmI42shrlrNI26b8
                                                                                                                                                                                                MD5:BE80E385F4A43E39B89AA315010E5AFC
                                                                                                                                                                                                SHA1:C48EF18CD412B3F8E96C8A9F10418C10BDC01557
                                                                                                                                                                                                SHA-256:6EC0894C8BEEEE04A033DFFBE2E54E1BC3C6C8CE4A75738F4E5A13EBA571B2D9
                                                                                                                                                                                                SHA-512:73FBC9F5EC906A6F95A2BCF002A021DA499AEB87023A77345416CA04FFA8148C776E90ADC0CE9F45FBF093F2D6506D0803ED5E73DC46A3DC747FCF71CFEB96DC
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/message_bubble_alert/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M4 2v20l5-5h11V2H4zm9 12h-2v-2h2v2zm0-3h-2V5h2v6z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 989

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                Entropy (8bit):5.04119913967567
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHmAIb0WNUoOUGf7/:tI9mc4slhLJ9hC/vmI4mtb0PCGz
                                                                                                                                                                                                MD5:DB8E084413F0D763A3EFBF3573AFC33A
                                                                                                                                                                                                SHA1:FF8264FCAAC48F90B0CB74E09D65655EFE09488B
                                                                                                                                                                                                SHA-256:A058F9F44A83FDF8074494F9322A40EF1B6E159DBEEF1E30BDECCE736AFD1E2D
                                                                                                                                                                                                SHA-512:28A6102E54D20BBAE6D0A4D98971FE4170392A3354B55FD504C0DD1A0896CB5E786D85AFD64EA9EC308009795EB4C8392F2CE22CCD8A6DC4B84CEBFC4929CDEE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/my_videos/v6/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m10 8 6 4-6 4V8zm11-5v18H3V3h18zm-1 1H4v16h16V4z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 990

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):220
                                                                                                                                                                                                Entropy (8bit):4.95427055782646
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4VJD2zPdqUQx+dt:t47N9U/vmRf2bQxS
                                                                                                                                                                                                MD5:64C5CFD76908E80E8D1C35BB65CF26CB
                                                                                                                                                                                                SHA1:DCDA22BE3CFBA2AF2C7CD98465F601E8B3C5888A
                                                                                                                                                                                                SHA-256:59BD8FAC9261910ADAE788A1BA4E550544F05A84312049D2C254FC37A7596CC1
                                                                                                                                                                                                SHA-512:37C54AF2F2D644BBA688775BC77FB0AED604F9ED4675FF89117A0AA264C62A0291AFC145A7D20C4C4D14F13E6C460CF6D39B1F925E442BD7A3A190BA77B98DE7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/audio/v5/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4V8h6V4h-7z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 991

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):259889
                                                                                                                                                                                                Entropy (8bit):5.404210528859754
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:cBlJQj9MPzJWnodfkei/E+sPKqno7TMbyzb8f:eJQ0z95PKqno7Tw
                                                                                                                                                                                                MD5:9D0FC0EA580E0D6FB1F604E2EEF55C8D
                                                                                                                                                                                                SHA1:181C495A7BE7CE596332355DB28E16A3FDFD49B1
                                                                                                                                                                                                SHA-256:235852C8D371A9D2352C70B3D951B6C3E9A39F553A522EFC7A6649DF6FD6918C
                                                                                                                                                                                                SHA-512:13FF392BA3473D495E944AA3559F33A74FBC9EABF39A8CD152345DEEB76F39F36C1B0288BF949F79233B179DDB8D4EAA8B532A80DFB15F134FFA9E5C46189323
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/9aqr8a0t3v3gde6w2txxdc9l9
                                                                                                                                                                                                Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=92)}([function(e,t,n){"use strict";n.d(t,"j",(function(){return a})),n.d(t,"x",(function(){re

                                                                                                                                                                                                Chrome Cache Entry: 992

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):374376
                                                                                                                                                                                                Entropy (8bit):5.207466711124167
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:sMi8ZHMCbS/SgV9UI3ILJPptpJKztM6oyi+MOn4y2Ox5juDEnXrDJc7MsByZ54cf:sMi8ZiSggImSoyJufmJ3ckIoNN
                                                                                                                                                                                                MD5:101CE6BEC017FDEDA83AACA342362AAA
                                                                                                                                                                                                SHA1:3495E40A0E1427DFE2668D100B748E3B2BE51C13
                                                                                                                                                                                                SHA-256:52535A880872C1C5273500B7F045580DFFFB0FE2A02852223E9E63DB92D41CC3
                                                                                                                                                                                                SHA-512:50A83664F427CA8A742031F4B42566510BE0A1A3D1CF671701BF47C038D963126E61B7B995ED2760F1E031F96D6D60D5E4757FAC2E60F766E9D34C1A85D3BFF4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/www-player.css
                                                                                                                                                                                                Preview:@charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-font-smoothing:antialiased;-webkit-tap-highlight-color:rgba(0,0,0,0);touch-action:manipulation;-ms-high-contrast-adjust:none;forced-color-adjust:none}.html5-video-player:not(.ytp-transparent),.html5-video-player.unstarted-mode,.html5-video-player.ad-showing,.html5-video-player.ended-mode{background-color:#000}.ytp-big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-webkit-transition:color .1s cubic-bezier(.4,0,1,1);transition:color .1s cubic-bezier(.4,0,1,1)}.ytp-probably-keyboard-focus a:focus{-webkit-box-shadow:inset 0 0 0 2px rgba(27,1

                                                                                                                                                                                                Chrome Cache Entry: 993

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):335
                                                                                                                                                                                                Entropy (8bit):4.848782964528927
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6xjU5SWcYISJ2gLGpnQEVRp3:t4noU/vmRxxVzMHUFXMU5SWclS4AuQQv
                                                                                                                                                                                                MD5:9F4AFB8B5C116B8C96AD6A0BF69021DB
                                                                                                                                                                                                SHA1:DA12B34E4705D9875C8CC67EFE0058698E537A78
                                                                                                                                                                                                SHA-256:61B18613E4A65CB373AED90B59C16370DF577861FBA91C5029B2BFFE6E14EAEB
                                                                                                                                                                                                SHA-512:3839B172D4A4C0A1D07829DF590C8B3F780DCED47C3C17C79B2B07E71DA35CAED39338E4FDF5A7D6A38C327DB481CD7C41BC601EABB9E01F6FED5D02BE083FE2
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/trophy/v1/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zM15 21H9v-1.39l3-1.54 3 1.54V21zm2-10c0 2.76-2.24 5-5 5s-5-2.24-5-5V3h10v8zm3-.62-2 1V6h2v4.38z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 994

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (10908)
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):505468
                                                                                                                                                                                                Entropy (8bit):5.590179591808246
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:cAv8IMwgRDK/6ZZgxKTQvgmCUrkAcQPuMl:jvHMwgdrZAvZIvQPuE
                                                                                                                                                                                                MD5:F97C02150C3F44443BB1440F2A0F2A76
                                                                                                                                                                                                SHA1:FB41A83615954ABF936300313A88DDD24E91DAE9
                                                                                                                                                                                                SHA-256:9507019EDBB2917C1FDA45E1362EADE70D8D49682178B9DC10AE76D125EDFD86
                                                                                                                                                                                                SHA-512:1A328D951E2AFEED83E1B491268AD0BF090ADD1A6D98515A6C12AE4B2E8A22BD168BB8EE1EFF584E72404CFC8C9806B39003D692B666EF792363D34CBF2D61D0
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3i61x4/yj/l/en_US/IBfLA_-Hc3YX4l9KW6OtIO5HlXZfwHVVUpDQfkyyTaWCGk-O-R8Gs6iASukEBADS5pGt_W8aRic8d2gl1bB5K5D6xrFAEAvqD7evPbvFcpHZo51i_pdlivXmw4aMnSkoKt8iH-UYrdZ9BV501U975kCvVo55aOb9HrqB9TzT2-6cQa0hMTxkhjBxcN4yrz4s0vErCSzXJNekCZ6S3.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometFeedStoryMenuQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7083058335113269"}),null);.__d("CometFeedStoryMenuQuery$Parameters",["CometFeedStoryMenuQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometFeedStoryMenuQuery_facebookRelayOperation"),metadata:{},name:"CometFeedStoryMenuQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometFeedStoryMenuSection_promotion.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometFeedStoryMenuSection_promotion",selections:[{alias:null,args:null,concreteType:"QuickPromotion",kind:"LinkedField",name:"local_alerts_story_menu_promotion",plural:!1,selections:[{args:null,kind:"FragmentSpread",name:"useCometTooltipQP_quickPromotion"}],storageKey:null}],type:"CometFeedStoryDefaultContextLayoutStrategy",abstractKey:null};e.exports=a}),null);.__d("useCometTooltipQP

                                                                                                                                                                                                Chrome Cache Entry: 995

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):65992
                                                                                                                                                                                                Entropy (8bit):7.996547563615925
                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                SSDEEP:1536:ZhV81AZNgv7wbUqNbMm+akMkaLzv2MXxULMA20BtVde7c5fmqach5OC:ZhVqAZyv7wR1KMvHzUD2uQmfIcvv
                                                                                                                                                                                                MD5:218703737E0894327BA5F79C86E6ACD5
                                                                                                                                                                                                SHA1:6C7C4192E540AA0DC5B034BAB86C4B8CE053A35B
                                                                                                                                                                                                SHA-256:93B1FFFA58CDE558DF9C7B5E23DE792A7BD82C29B3CF87F9298C0058F119FD58
                                                                                                                                                                                                SHA-512:DC5E489C754E2968D94D51418F6B2116AA05EAC2DC758F294C0F746A043F5372ED07B157D52A37E19AA793BAF637D966488A08CD2263A97DA3CCB53B91D1440C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://i.ytimg.com/vi/nXyZFHVOEEw/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLA0bw0AXg30wQA1blFhmhDEOZni4w
                                                                                                                                                                                                Preview:RIFF....WEBPVP8 .........*....>Q .D..!!+.{.p..ck...{..q.\.....EW..9........F..]...*.g.?................W.....~..|.....7...{.........W./.....?.?....v.....+._........+.........w............2......+...w..a_...?..}|h...w.....S........B.................M.[.......?l.....?..~.3.....?._)...>.....*.'..._...s.z............o...?...G.....x.+.......7...._.)........G./......_.w..}.....g.o.?......G.O.........?w?......'....P..............?..........O._........%.......?....S...O.O...........c....._....r?.{.......G...j.3.[...hX..*..=k.:/ZB.Eq.T..-.............%w....|<.............+..V.O.....0C.z;..?.....B....P. .V..........<........{.m.\..OR...*.:C...F.Y..#.r.R.......R..`...k.9....V.vJ{.K..#.....p...1.[...$....rM{........HU..........9..s..#z@.L.z.R'e^...r...4..V..).W..R/}b.-&..tqh.D....n._.5.!..:9..........."*7....a...\=.sn-./..h..+..Vq.<p.{...n,)A.)e.(..fm.2u....7.)..4h..Z.B....{.._...N....\A...Y..t`.M.qg|.....>.".U..O,.9...E.#.....A.c.6<...k!.g.

                                                                                                                                                                                                Chrome Cache Entry: 996

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1528
                                                                                                                                                                                                Entropy (8bit):6.947926614968134
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:gqEMTnshc1spCueHVsSiiO7QJS8nE0zoYa+lZtkUlyeHwDch7ZOHIUysOB9sOqb:gknqiWC5Y7Qs6E0z2AZCU4ePh1oIUqBY
                                                                                                                                                                                                MD5:65F154A4FB02D83BF797E1B5E7C24AD4
                                                                                                                                                                                                SHA1:F7A3C723DF37E4329A98612748E34A966605CE1D
                                                                                                                                                                                                SHA-256:079D71960FA1A5246AE1B5BF72297A725AB0BCB7C1AEFBC96C5E2F0FD1D099D7
                                                                                                                                                                                                SHA-512:4B01B6D16754DFED4B73A1402621D4562F63C256F1837B3324FA6DA5E9481597DD04B94C0611FAE1AE8C211C2158DA0A3A445CE38D0F0299525C3F6FD08452D4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/273705315_515012886650738_8110129105722434845_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=7U-JVsnlxWMAX_mfj1E&_nc_ht=scontent-lga3-2.xx&oh=00_AfCig9pjHPgoJCl-DSKMYKZ6vXDsKfV_t0eczzzZAryt7A&oe=65D390DF
                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6b010000d30100006602000087020000bf02000089030000420400007204000093040000c3040000f8050000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................@..$].N....l.....k.{k..)...Z.E.0U..h.8.Sm.`y.'.@`...."............................. 1%............z..eJ....&....x.q..n...#.J...w..k..XP...yE..b;....@.Q...t.e(.V.n.k..F.P..0......{..).U5.]..i.....1..`~;.o.....................@........?.......................@........?.....+........................!21AQ.."#r.. 4q..........?..lf.....e.../....V....(..S.n...\K..........t,....._K._.2T.v....-.Tt....K.D...$.9...).T...EL...{s...X.t.69..p...=K.o..z.........$U...y...u.i..Q{1..zq...$....................!1AQ.aq.. ............?!....S>..+..O...E....L.0.;.0E.r.4......t..K(....I..R..H.V...LX..$z.7........#0k>..

                                                                                                                                                                                                Chrome Cache Entry: 997

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):561
                                                                                                                                                                                                Entropy (8bit):4.664076278294878
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRBoGaBoVOLgbvSFWeGzE+5OPiufVKJXbsUFSQiYHUloL:t4jU/vRGaBoc2SLX9fUb12NSL
                                                                                                                                                                                                MD5:627CBC730DA8617E4FDA79BB7FC35F2F
                                                                                                                                                                                                SHA1:C1CF15F3D7BD2AC64B329E353D26771F5C13FE77
                                                                                                                                                                                                SHA-256:817119ECC2BC54779A271A53B347E8AF33C2544934D642D7877E99267BB0745B
                                                                                                                                                                                                SHA-512:FB2299DC0272ECE197FE5656C0ABF1E6CF96F5D25F3D135D2DCE3D7CF50C189BC0C9C73D1B042020DB47B2FD680230C61F9A6D599D385CEFFAC87F20CEB69555
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/thumb_up/v17/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M18.77,11h-4.23l1.52-4.94C16.38,5.03,15.54,4,14.38,4c-0.58,0-1.14,0.24-1.52,0.65L7,11H3v10h4h1h9.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z M7,20H4v-8h3V20z M19.98,13.17l-1.34,6 C18.54,19.65,18.03,20,17.43,20H8v-8.61l5.6-6.06C13.79,5.12,14.08,5,14.38,5c0.26,0,0.5,0.11,0.63,0.3 c0.07,0.1,0.15,0.26,0.09,0.47l-1.52,4.94L13.18,12h1.35h4.23c0.41,0,0.8,0.17,1.03,0.46C19.92,12.61,20.05,12.86,19.98,13.17z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 998

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):241
                                                                                                                                                                                                Entropy (8bit):5.137838894912298
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4hNpDCbNBdANjcmgTLMAqY:t47N9U/vmRhNpCsYNLzqY
                                                                                                                                                                                                MD5:2BEBB6EA2A23E97C81427106D9722D4E
                                                                                                                                                                                                SHA1:38DC371BFBF0DCA768A702E89ED00877F34621E7
                                                                                                                                                                                                SHA-256:4C4B6AEA58201D13608EEB52B960E052E9C7D677B7281CAF0E6B713A3E2F223B
                                                                                                                                                                                                SHA-512:F4BE381ECF6616EB82FC4B139BC67E6EEE70B1B71581150FF4E69E09E0B6EDA8729536413CDAAB38642F0616944089F96A3DA8369B56870D1118E91B67C2FEC9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/news/v2/24px.svg
                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M3 3.03V21h14l4-4V3.03H3zM6 6h12v2H6V6zm7 9v-2h5v2h-5zm0-3v-2h5v2h-5zm-1 6H6v-8h6v8zm4-2h3.99L16 19.99V16z"/></svg>

                                                                                                                                                                                                Chrome Cache Entry: 999

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                File Type:ASCII text, with very long lines (1011), with no line terminators
                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                Size (bytes):1011
                                                                                                                                                                                                Entropy (8bit):4.958228722086236
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:WybE3QpQgbgbGNKOkhOXO6FOXOWOvOOpx+FUDx+W:WybEgpQgbgbGNNlOOpx4UDx+W
                                                                                                                                                                                                MD5:5306F13DFCF04955ED3E79FF5A92581E
                                                                                                                                                                                                SHA1:4A8927D91617923F9C9F6BCC1976BF43665CB553
                                                                                                                                                                                                SHA-256:6305C2A6825AF37F17057FD4DCB3A70790CC90D0D8F51128430883829385F7CC
                                                                                                                                                                                                SHA-512:E91ECD1F7E14FF13035DD6E76DFA4FA58AF69D98E007E2A0D52BFF80D669D33BEB5FAFEFE06254CBC6DD6713B4C7F79C824F641CB704142E031C68ECCB3EFED3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/bdb59273/cssbin/www-onepick.css
                                                                                                                                                                                                Preview:.picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;background-color:#fff;border:1px solid #acacac;width:auto;padding:0;z-index:1001;overflow:auto;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-transition:top .5s ease-in-out;-moz-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;-webkit-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;transition:top .5s ease-in-out}.picker-min{position:absolute;z-index:1002}.picker.modal-dialog-content{font-size:0;padding:0}.picker.modal-dialog-title{height:0;margin:0}.picker.modal-dialog-title-text,.picker.modal-dialog-buttons{display:none}.picker.modal-dialog-bg,.picker.modal-dialog.picker-dialog{z-index:1999999999

                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                General

                                                                                                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                Entropy (8bit):7.933479637135835
                                                                                                                                                                                                TrID:
                                                                                                                                                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                File name:jk98mGM6JH.exe
                                                                                                                                                                                                File size:2'393'600 bytes
                                                                                                                                                                                                MD5:736549a437da8dacb4c1d31c33ba75b8
                                                                                                                                                                                                SHA1:7eb5e89620f4a6de369a9667133cb2ef01d27ed3
                                                                                                                                                                                                SHA256:6fc1848ea0691845f977875ff74a353cbae23c75011c427720ec37659784860f
                                                                                                                                                                                                SHA512:ada7dcd0eb06696ae6792f7d50ca10165cc55532d31c71f2a7a19b60876e826ec22d4c3604833ff19a36dff8caa14ac8bb6bf4372bafc3a6602be9849a84e09e
                                                                                                                                                                                                SSDEEP:49152:bnzYkijkaP8vRxUoDuBivcf9hKzs3YRHj6hzfaybLaXhjjv8Eb0ybBpa:bnQj2PUoD50Kyl9bLaXN86ZO
                                                                                                                                                                                                TLSH:26B5238D6C404057E79C373518C2F77A1669FD89BC85A4DDACDD7F63BA33A280922A1C
                                                                                                                                                                                                File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C...............L.......L.......L.......H.G.....H.......H.......H...R...L.......L.......L.........................E.......-....

                                                                                                                                                                                                File Icon

                                                                                                                                                                                                Icon Hash:7192ecece8b2924d

                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                General

                                                                                                                                                                                                Entrypoint:0x9bc000
                                                                                                                                                                                                Entrypoint Section:.taggant
                                                                                                                                                                                                Digitally signed:false
                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                Time Stamp:0x65CC7EFE [Wed Feb 14 08:51:10 2024 UTC]
                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                OS Version Major:6
                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                File Version Major:6
                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                Subsystem Version Major:6
                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                Instruction
                                                                                                                                                                                                jmp 00007F41B11F7E6Ah
                                                                                                                                                                                                pcmpgtb mm4, qword ptr [eax+eax]
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                jmp 00007F41B11F9E65h
                                                                                                                                                                                                add byte ptr [edx+ecx], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                adc byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                push es
                                                                                                                                                                                                or al, byte ptr [eax]
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [edx+ecx], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                push es
                                                                                                                                                                                                or al, byte ptr [eax]
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [ecx], cl
                                                                                                                                                                                                add byte ptr [eax], 00000000h
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                adc byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                pop es
                                                                                                                                                                                                or al, byte ptr [eax]
                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                add byte ptr [eax], al

                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x1490540x68.idata
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x1370000x110a0.rsrc
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x1491f80x8.idata
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                Sections

                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                0x10000x1360000x8f000526371db616613836e7c6571ed8b46c1False0.9993478201486014data7.988716513246667IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                .rsrc0x1370000x110a00x2000f4328fe639d4e77edd541ebb07aa7b52False0.9827880859375data7.904002209424786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                .idata 0x1490000x10000x200588e00183b8b4dbb8c7106492f04143dFalse0.14453125data0.9824704719748909IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                0x14a0000x2bd0000x2005308350e05d69b19f4c24a9bc49f90d9unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                idnrjgyt0x4070000x1b40000x1b3a0065f02ad653bb94a5abaf9484fbbfe296False0.9608209289813486data7.913450001679227IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                ssvxgfuk0x5bb0000x10000x600ec146673f8192747d6ef5ce1879d247cFalse0.6022135416666666data5.136390709108435IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                .taggant0x5bc0000x30000x2200c4336996d52c7c3bb8618f20eb6f9c90False0.06491268382352941DOS executable (COM)0.7443786592657285IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                                                                                                                                Resources

                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                RT_ICON0x5a9aa80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mRussianRussia0.10367620962971726
                                                                                                                                                                                                RT_GROUP_ICON0x5ba2d00x14dataRussianRussia1.15
                                                                                                                                                                                                RT_VERSION0x5ba2e40x2b4dataRussianRussia0.48121387283236994
                                                                                                                                                                                                RT_MANIFEST0x5ba5980x2e6XML 1.0 document, ASCII text, with CRLF line terminators0.45417789757412397
                                                                                                                                                                                                RT_MANIFEST0x5ba87e0x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                                                                                                                                                                                Imports

                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                kernel32.dlllstrcpy

                                                                                                                                                                                                Possible Origin

                                                                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                RussianRussia
                                                                                                                                                                                                EnglishUnited States

                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                Statistics

                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                Behavior

                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                Start time:23:20:00
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:C:\Users\user\Desktop\jk98mGM6JH.exe
                                                                                                                                                                                                Imagebase:0x610000
                                                                                                                                                                                                File size:2'393'600 bytes
                                                                                                                                                                                                MD5 hash:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2099303367.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2670860055.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:2
                                                                                                                                                                                                Start time:23:20:05
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                Imagebase:0xe40000
                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                Start time:23:20:05
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                Start time:23:20:05
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                Imagebase:0xe40000
                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                Start time:23:20:05
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                Start time:23:20:06
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                Imagebase:0x390000
                                                                                                                                                                                                File size:2'393'600 bytes
                                                                                                                                                                                                MD5 hash:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.2159594281.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                • Detection: 42%, ReversingLabs
                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:10
                                                                                                                                                                                                Start time:23:20:06
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                Imagebase:0x390000
                                                                                                                                                                                                File size:2'393'600 bytes
                                                                                                                                                                                                MD5 hash:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.3050100739.0000000000391000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.2161145290.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                Start time:23:20:15
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                                                Imagebase:0x1000000
                                                                                                                                                                                                File size:2'393'600 bytes
                                                                                                                                                                                                MD5 hash:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000D.00000003.2269427007.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000D.00000002.2539923574.0000000001001000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                • Detection: 42%, ReversingLabs
                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                Start time:23:20:18
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\PLO4plFr34jobsiEh08j.exe"
                                                                                                                                                                                                Imagebase:0xc00000
                                                                                                                                                                                                File size:918'016 bytes
                                                                                                                                                                                                MD5 hash:791ED44F9B3836A68F79B028EF7C49CB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                Start time:23:20:18
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                Start time:23:20:18
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                                                                                                                                                                                                Imagebase:0x7ff7934f0000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                Start time:23:20:19
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                Start time:23:20:19
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=1972,i,16301593684436752617,2012107364916416146,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                Start time:23:20:20
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1960,i,11993553605994081514,18162534353999161792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:22
                                                                                                                                                                                                Start time:23:20:20
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                Start time:23:20:21
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,17726353602255924015,12176223097910466274,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:24
                                                                                                                                                                                                Start time:23:20:21
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1984,i,8973374208484498469,2501955192980366572,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:25
                                                                                                                                                                                                Start time:23:20:21
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\zqdrYwv5fC6zkQ9Tresm.exe"
                                                                                                                                                                                                Imagebase:0x180000
                                                                                                                                                                                                File size:1'750'528 bytes
                                                                                                                                                                                                MD5 hash:1C8A50F3E51F6AE258F38752193B1448
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:26
                                                                                                                                                                                                Start time:23:20:22
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:27
                                                                                                                                                                                                Start time:23:20:22
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:28
                                                                                                                                                                                                Start time:23:20:22
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:29
                                                                                                                                                                                                Start time:23:20:23
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:30
                                                                                                                                                                                                Start time:23:20:23
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:31
                                                                                                                                                                                                Start time:23:20:23
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                                                                                                                                                                                                Imagebase:0x7ff684c40000
                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:32
                                                                                                                                                                                                Start time:23:20:24
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2092,i,17673521410042216198,2537652209419044310,262144 /prefetch:3
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:33
                                                                                                                                                                                                Start time:23:20:24
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:34
                                                                                                                                                                                                Start time:23:20:24
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                                                Imagebase:0x1000000
                                                                                                                                                                                                File size:2'393'600 bytes
                                                                                                                                                                                                MD5 hash:736549A437DA8DACB4C1D31C33BA75B8
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000022.00000003.2508379808.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000022.00000002.2670001934.0000000001001000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:35
                                                                                                                                                                                                Start time:23:20:24
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,12923574770636312838,3728738922740556079,262144 /prefetch:3
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:36
                                                                                                                                                                                                Start time:23:20:25
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:37
                                                                                                                                                                                                Start time:23:20:25
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:38
                                                                                                                                                                                                Start time:23:20:25
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2160,i,17832719417900444124,13861847247960682782,262144 /prefetch:3
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:39
                                                                                                                                                                                                Start time:23:20:25
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:40
                                                                                                                                                                                                Start time:23:20:26
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\heidiVWl4S6kyYSYh\Cr6QVRpzwqhYjtnCxFSW.exe"
                                                                                                                                                                                                Imagebase:0xe50000
                                                                                                                                                                                                File size:3'109'888 bytes
                                                                                                                                                                                                MD5 hash:880AA312796089DC66459C024727D591
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:Borland Delphi
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000028.00000002.2665861162.0000000000E51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:41
                                                                                                                                                                                                Start time:23:20:26
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:42
                                                                                                                                                                                                Start time:23:20:26
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:43
                                                                                                                                                                                                Start time:23:20:27
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2940 --field-trial-handle=2724,i,4482519872048150816,8688360613915830786,262144 /prefetch:3
                                                                                                                                                                                                Imagebase:0x7ff715da0000
                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                MD5 hash:BF154738460E4AB1D388970E1AB13FAB
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:44
                                                                                                                                                                                                Start time:23:20:27
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:45
                                                                                                                                                                                                Start time:23:20:29
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:46
                                                                                                                                                                                                Start time:23:20:29
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:47
                                                                                                                                                                                                Start time:23:20:30
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:48
                                                                                                                                                                                                Start time:23:20:32
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2188 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07a9cf11-a11c-4267-8dc4-740bf294e4fb} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d8896bf10 socket
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:52
                                                                                                                                                                                                Start time:23:20:41
                                                                                                                                                                                                Start date:15/02/2024
                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3432 -prefsLen 21837 -prefMapSize 238690 -jsInitHandle 1240 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b753b1f8-541a-487d-8ec8-3be5703ede91} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" 25d99d93310 tab
                                                                                                                                                                                                Imagebase:0x7ff728280000
                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                  Execution Coverage:16%
                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:14.4%
                                                                                                                                                                                                  Signature Coverage:63.7%
                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                  Total number of Limit Nodes:157
                                                                                                                                                                                                  execution_graph 74161 62ec20 74162 62f0bf 74161->74162 74167 62ec5e 74161->74167 74163 62eca7 setsockopt recv 74163->74167 74165 62f0aa Sleep 74165->74162 74165->74167 74167->74162 74167->74163 74167->74165 74169 62f09c Sleep 74167->74169 74174 678610 4 API calls 74167->74174 74177 62db60 WSAStartup 74167->74177 74183 678610 74167->74183 74188 675d50 74167->74188 74205 62e460 74167->74205 74220 624a90 74167->74220 74223 62e060 74167->74223 74169->74165 74170 62ed38 recv 74170->74167 74171 62ed59 recv 74170->74171 74171->74167 74175 62edc1 setsockopt recv 74174->74175 74175->74167 74178 62db98 74177->74178 74181 62dc56 74177->74181 74179 62dc24 socket 74178->74179 74178->74181 74180 62dc3a connect 74179->74180 74179->74181 74180->74181 74182 62dc4c closesocket 74180->74182 74181->74167 74182->74179 74182->74181 74184 678657 74183->74184 74187 678628 __fread_nolock 74183->74187 74238 67ba20 74184->74238 74186 67866a 74186->74170 74187->74170 74189 675d7a 74188->74189 74190 675e32 74189->74190 74191 675d8b 74189->74191 74193 612040 4 API calls 74190->74193 74192 675d97 std::locale::_Locimp::_Locimp 74191->74192 74194 675dbc 74191->74194 74197 675df5 74191->74197 74198 675dfe 74191->74198 74192->74167 74195 675e37 74193->74195 74199 6ecd02 std::_Facet_Register 4 API calls 74194->74199 74295 611fa0 4 API calls 2 library calls 74195->74295 74197->74194 74197->74195 74202 6ecd02 std::_Facet_Register 4 API calls 74198->74202 74203 675dd6 std::locale::_Locimp::_Locimp 74198->74203 74200 675dcf 74199->74200 74201 6f2220 3 API calls 74200->74201 74200->74203 74204 675e41 74201->74204 74202->74203 74203->74167 74204->74167 74208 62e4d5 74205->74208 74206 62ebdd 74206->74167 74207 6f2220 3 API calls 74209 62ec00 74207->74209 74208->74206 74208->74207 74296 6ebf2b 8 API calls std::locale::_Setgloballocale 74209->74296 74297 6ec6dc 74220->74297 74222 624a9b __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 74222->74167 74224 675d50 4 API calls 74223->74224 74229 62e0aa 74224->74229 74226 62e204 74227 62e44b 74226->74227 74228 62e22e 74226->74228 74230 6f2220 3 API calls 74227->74230 74231 678610 4 API calls 74228->74231 74236 62e26e std::locale::_Locimp::_Locimp 74228->74236 74304 675bd0 74229->74304 74235 62e3b7 74230->74235 74231->74236 74232 6f2220 3 API calls 74233 62e455 74232->74233 74234 62e423 74234->74167 74235->74232 74235->74234 74236->74235 74237 62e393 WSASend 74236->74237 74237->74235 74237->74236 74239 67ba45 74238->74239 74240 67bb6c 74238->74240 74241 67ba5a 74239->74241 74245 67baa6 74239->74245 74246 67bab3 74239->74246 74261 612040 74240->74261 74253 6ecd02 74241->74253 74243 67bb71 74264 611fa0 4 API calls 2 library calls 74243->74264 74245->74241 74245->74243 74249 6ecd02 std::_Facet_Register 4 API calls 74246->74249 74251 67ba6a __fread_nolock std::locale::_Locimp::_Locimp 74246->74251 74249->74251 74252 67bb2a __fread_nolock std::locale::_Locimp::_Locimp 74251->74252 74265 6f2220 74251->74265 74252->74186 74255 6ecd07 std::_Facet_Register 74253->74255 74256 6ecd21 74255->74256 74258 611fa0 Concurrency::cancel_current_task 74255->74258 74268 6fb99c 74255->74268 74256->74251 74257 6ecd2d 74257->74257 74258->74257 74274 6ee0c1 74258->74274 74293 6eb15b 4 API calls 2 library calls 74261->74293 74264->74251 74294 6f215c ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 74265->74294 74267 6f222f __Getctype 74273 70489d std::_Facet_Register __Getcoll 74268->74273 74269 7048db 74282 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 74269->74282 74270 7048c6 RtlAllocateHeap 74272 7048d9 74270->74272 74270->74273 74272->74255 74273->74269 74273->74270 74275 6ee0ce 74274->74275 74281 611fe3 74274->74281 74276 6fb99c ___std_exception_copy 3 API calls 74275->74276 74275->74281 74277 6ee0eb 74276->74277 74280 6ee0fb 74277->74280 74283 703128 ExitProcess RtlAllocateHeap RtlFreeHeap __dosmaperr ___std_exception_copy 74277->74283 74284 6fb246 74280->74284 74281->74251 74282->74272 74283->74280 74287 704823 74284->74287 74288 6fb25e 74287->74288 74289 70482e RtlFreeHeap 74287->74289 74288->74281 74289->74288 74290 704843 __dosmaperr 74289->74290 74292 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 74290->74292 74292->74288 74294->74267 74295->74200 74300 6eccdc 74297->74300 74301 6ecced GetSystemTimePreciseAsFileTime 74300->74301 74302 6ec6ea 74300->74302 74301->74302 74302->74222 74305 675c01 74304->74305 74306 675bde 74304->74306 74305->74226 74306->74305 74307 6f2220 3 API calls 74306->74307 74308 675c4c 74307->74308 74309 5120397 74310 51203a1 74309->74310 74311 51203a6 Process32FirstW 74309->74311 74310->74311 74312 51203e3 74311->74312 74313 65db00 74336 65db42 74313->74336 74314 65ee26 74832 6502f0 74314->74832 74317 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74317->74336 74319 65ee6c 74324 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74324->74336 74327 673850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74327->74336 74328 638510 17 API calls 74328->74336 74330 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74330->74336 74332 673450 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74332->74336 74336->74314 74336->74317 74336->74324 74336->74327 74336->74328 74336->74330 74336->74332 74337 65f030 15 API calls 74336->74337 74338 6346d0 74336->74338 74401 635a30 74336->74401 74539 63a700 74336->74539 74603 63ba00 74336->74603 74746 640fb0 74336->74746 74861 681160 15 API calls 2 library calls 74336->74861 74862 672580 24 API calls 74336->74862 74337->74336 74918 677750 74338->74918 74343 679e00 4 API calls 74344 634798 __fread_nolock 74343->74344 74344->74344 74345 6359c7 74344->74345 74941 67d790 74344->74941 74346 612040 4 API calls 74345->74346 74376 6348cb 74346->74376 74348 63484f 74349 634881 74348->74349 74350 634d04 74348->74350 74352 675d50 4 API calls 74349->74352 75151 682940 74350->75151 74351 6f2220 3 API calls 74354 6359d1 74351->74354 74355 634892 74352->74355 75198 612700 74354->75198 74373 63497d 74373->74336 74376->74351 74376->74373 76258 673bc0 74401->76258 74404 673b90 4 API calls 74405 635aae 74404->74405 74406 679e00 4 API calls 74405->74406 74407 635ae5 __fread_nolock 74406->74407 76261 679b50 74407->76261 74410 635d55 74413 612700 4 API calls 74410->74413 74411 635b6a 74412 675d50 4 API calls 74411->74412 74414 635b7b 74412->74414 74415 635d65 74413->74415 74416 630720 15 API calls 74414->74416 76361 6749f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74415->76361 74418 635b8a 74416->74418 74419 635d78 74540 677750 4 API calls 74539->74540 74541 63a75a 74540->74541 74542 673b90 4 API calls 74541->74542 74543 63a782 74542->74543 74544 679e00 4 API calls 74543->74544 74545 63a7bd __fread_nolock 74544->74545 74545->74545 74546 63b991 74545->74546 74547 67d790 4 API calls 74545->74547 74548 612040 4 API calls 74546->74548 74549 63a882 74547->74549 74578 63a8fe 74548->74578 74550 63a8b4 74549->74550 74551 63ad2b 74549->74551 74553 675d50 4 API calls 74550->74553 74554 682940 4 API calls 74551->74554 74552 6f2220 3 API calls 74555 63b99b 74552->74555 74556 63a8c5 74553->74556 74566 63ad29 74554->74566 74558 612700 4 API calls 74555->74558 74557 630720 15 API calls 74556->74557 74559 63a8d0 74557->74559 74560 63b9b2 74558->74560 74561 63a8f6 74559->74561 74577 63a9b5 74559->74577 74562 679bb0 4 API calls 74560->74562 74563 677f40 5 API calls 74561->74563 74569 63b9c7 74562->74569 74563->74578 74564 63b8fd 74570 677f40 5 API calls 74564->74570 74565 63ad1a 74568 677f40 5 API calls 74565->74568 74567 682940 4 API calls 74566->74567 74566->74578 74582 63adeb __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z std::locale::_Locimp::_Locimp 74566->74582 74567->74582 74568->74566 74571 618920 4 API calls 74569->74571 74570->74578 74572 63b9df Concurrency::cancel_current_task 74571->74572 74573 63a9b0 74573->74336 74574 673b90 4 API calls 74574->74582 74575 67d790 4 API calls 74575->74577 74576 673450 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74576->74582 74577->74546 74577->74565 74577->74575 74577->74578 74579 675ad0 4 API calls 74577->74579 74580 630720 15 API calls 74577->74580 74581 677f40 5 API calls 74577->74581 74585 675d50 4 API calls 74577->74585 76975 682a60 4 API calls 3 library calls 74577->76975 74578->74552 74578->74573 74579->74577 74580->74577 74581->74577 74582->74546 74582->74555 74582->74564 74582->74574 74582->74576 74582->74578 74583 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74582->74583 74584 67d5a0 4 API calls 74582->74584 74586 67bb80 4 API calls 74582->74586 74588 6244f0 14 API calls 74582->74588 74589 6d2690 3 API calls 74582->74589 74590 624920 10 API calls 74582->74590 74591 6aefc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 74582->74591 74592 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74582->74592 74594 6adfd0 3 API calls 74582->74594 74595 6abe90 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 74582->74595 74596 6ecd02 std::_Facet_Register 4 API calls 74582->74596 74597 69d970 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 74582->74597 74598 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74582->74598 74599 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74582->74599 74602 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74582->74602 76976 6fa8a6 74582->76976 76982 67cf10 74582->76982 76992 6addc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 74582->76992 74583->74582 74584->74582 74585->74577 74586->74582 74588->74582 74589->74582 74590->74582 74591->74582 74592->74582 74594->74582 74595->74582 74596->74582 74597->74582 74598->74582 74599->74582 74602->74582 74604 673bc0 4 API calls 74603->74604 74605 63ba53 74604->74605 74606 673b90 4 API calls 74605->74606 74607 63ba7d 74606->74607 74608 679e00 4 API calls 74607->74608 74609 63baa9 __fread_nolock 74608->74609 74610 679b50 4 API calls 74609->74610 74611 63bb01 74610->74611 74612 63bb34 74611->74612 74613 63bece 74611->74613 74615 675d50 4 API calls 74612->74615 74614 612700 4 API calls 74613->74614 74616 63bede 74614->74616 74617 63bb45 74615->74617 77034 6749f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74616->77034 74619 630720 15 API calls 74617->74619 74621 63bb50 74619->74621 74620 63bef4 74622 612660 3 API calls 74620->74622 74624 63bb63 74621->74624 74691 63bb9b 74621->74691 74623 63becc 74622->74623 74628 612700 4 API calls 74623->74628 74632 63bf5c 74623->74632 74625 677f40 5 API calls 74624->74625 74627 63bb68 74625->74627 74626 63bebd 74629 677f40 5 API calls 74626->74629 74630 677f40 5 API calls 74627->74630 74631 63bf37 74628->74631 74629->74623 74633 63dd94 74632->74633 74636 67d790 4 API calls 74632->74636 74650 679a90 4 API calls 74650->74691 74657 679cb0 4 API calls 74657->74691 74663 630720 15 API calls 74663->74691 74673 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 74673->74691 74681 677f40 5 API calls 74681->74691 74689 675d50 4 API calls 74689->74691 74691->74626 74691->74650 74691->74657 74691->74663 74691->74673 74691->74681 74691->74689 77025 679af0 74691->77025 77033 682a60 4 API calls 3 library calls 74691->77033 74747 64102f __fread_nolock 74746->74747 74748 6429d2 74747->74748 74750 67d790 4 API calls 74747->74750 74749 612040 4 API calls 74748->74749 74776 641121 74749->74776 74751 64109f 74750->74751 74753 6410d6 74751->74753 74754 64155a 74751->74754 74752 6f2220 3 API calls 74755 6429dc 74752->74755 74756 675d50 4 API calls 74753->74756 74757 682940 4 API calls 74754->74757 74758 612040 4 API calls 74755->74758 74759 6410e7 74756->74759 74764 641555 74757->74764 74760 6429e1 74758->74760 74761 630720 15 API calls 74759->74761 74762 6f2220 3 API calls 74760->74762 74763 6410f3 74761->74763 74765 6429e6 74762->74765 74766 641119 74763->74766 74782 6411d8 74763->74782 74770 682940 4 API calls 74764->74770 74774 641614 74764->74774 74764->74776 77169 679310 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74765->77169 74768 677f40 5 API calls 74766->74768 74768->74776 74769 641549 74771 677f40 5 API calls 74769->74771 74770->74774 74771->74764 74774->74755 74774->74774 74774->74776 74780 67d790 4 API calls 74774->74780 74776->74752 74777 6411d3 74776->74777 74777->74336 74779 67d790 4 API calls 74779->74782 74783 641747 74780->74783 74782->74748 74782->74769 74782->74776 74782->74779 74785 675ad0 4 API calls 74782->74785 74790 630720 15 API calls 74782->74790 74796 677f40 5 API calls 74782->74796 74805 675d50 4 API calls 74782->74805 77164 682a60 4 API calls 3 library calls 74782->77164 74786 61b890 9 API calls 74783->74786 74785->74782 74789 64175b 74786->74789 74791 67a190 5 API calls 74789->74791 74827 641910 74789->74827 74790->74782 74792 6417b6 74791->74792 74799 679e00 4 API calls 74792->74799 74795 677f40 5 API calls 74795->74776 74796->74782 74798 6428aa 74798->74776 74798->74795 74801 6417f4 74799->74801 74801->74801 74803 679e00 4 API calls 74801->74803 74801->74827 74802 67d5a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74802->74827 74804 641834 74803->74804 74805->74782 74807 61b890 9 API calls 74807->74827 74811 67a190 5 API calls 74811->74827 74813 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74813->74827 74817 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74817->74827 74820 675a60 4 API calls 74820->74827 74821 675930 4 API calls 74821->74827 74822 630720 15 API calls 74822->74827 74823 677f40 5 API calls 74823->74827 74824 679f40 4 API calls 74824->74827 74825 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74825->74827 74827->74748 74827->74760 74827->74765 74827->74776 74827->74798 74827->74802 74827->74807 74827->74811 74827->74813 74827->74817 74827->74820 74827->74821 74827->74822 74827->74823 74827->74824 74827->74825 74830 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74827->74830 77040 640830 74827->77040 77166 612540 5 API calls std::locale::_Locimp::_Locimp 74827->77166 77167 681a40 24 API calls 74827->77167 77168 672580 24 API calls 74827->77168 74830->74827 74833 673bc0 4 API calls 74832->74833 74834 65033c 74833->74834 74835 673b90 4 API calls 74834->74835 74836 65036f 74835->74836 74837 679e00 4 API calls 74836->74837 74860 650397 __fread_nolock 74837->74860 74838 6503dc RegOpenKeyExA 74838->74860 74839 65116e 74863 679e00 74839->74863 74840 675b70 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74840->74860 74841 62ff60 5 API calls 74841->74860 74842 651187 74844 612700 4 API calls 74842->74844 74843 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74843->74860 74845 65119e 74844->74845 74847 679bb0 4 API calls 74845->74847 74846 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74846->74860 74848 6511b3 74847->74848 74849 618920 4 API calls 74848->74849 74850 6511cb Concurrency::cancel_current_task 74849->74850 74852 6f2220 3 API calls 74850->74852 74851 6ecd02 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 74851->74860 74853 6511e4 74852->74853 74854 67cf10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74854->74860 74855 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74855->74860 74856 679e00 4 API calls 74856->74860 74859 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 74859->74860 74860->74838 74860->74839 74860->74840 74860->74841 74860->74842 74860->74843 74860->74846 74860->74850 74860->74851 74860->74854 74860->74855 74860->74856 74860->74859 77623 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 74860->77623 77624 6127b0 ExitProcess RtlAllocateHeap RtlFreeHeap 74860->77624 74861->74336 74862->74336 74864 679e45 74863->74864 74865 679e38 74863->74865 74867 679eee 74864->74867 74868 679e5a 74864->74868 74866 677750 4 API calls 74865->74866 74866->74864 74869 612700 4 API calls 74867->74869 74870 612830 4 API calls 74868->74870 74871 679efe 74869->74871 74872 679e93 74870->74872 74873 679bb0 4 API calls 74871->74873 74874 67cf10 4 API calls 74872->74874 74875 679f13 74873->74875 74877 679ea5 Concurrency::cancel_current_task 74874->74877 74876 618920 4 API calls 74875->74876 74876->74877 74878 679ecd 74877->74878 74879 6f2220 3 API calls 74877->74879 74878->74319 74880 679f3e 74879->74880 74919 6778b3 74918->74919 74920 677792 74918->74920 74925 612700 4 API calls 74919->74925 74937 63472a 74919->74937 74921 677817 74920->74921 74922 677857 74920->74922 74923 6777f5 74920->74923 74924 677799 74920->74924 74920->74937 74927 6ecd02 std::_Facet_Register 4 API calls 74921->74927 74928 6ecd02 std::_Facet_Register 4 API calls 74922->74928 74926 6ecd02 std::_Facet_Register 4 API calls 74923->74926 74929 6ecd02 std::_Facet_Register 4 API calls 74924->74929 74930 6778ce 74925->74930 74926->74937 74931 67781e 74927->74931 74928->74937 74932 6777a0 74929->74932 75235 618ce0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 74930->75235 75219 612830 74931->75219 74935 6ecd02 std::_Facet_Register 4 API calls 74932->74935 74935->74937 74936 6778e1 Concurrency::cancel_current_task 74938 673b90 74937->74938 75237 677a90 74938->75237 74942 67d7c3 74941->74942 74946 67d7ee std::locale::_Locimp::_Locimp 74941->74946 74943 67d7d0 74942->74943 74944 67d813 74942->74944 74945 67d81c 74942->74945 74947 6ecd02 std::_Facet_Register 4 API calls 74943->74947 74944->74943 74948 67d86d 74944->74948 74945->74946 74951 6ecd02 std::_Facet_Register 4 API calls 74945->74951 74946->74348 74949 67d7e3 74947->74949 75254 611fa0 4 API calls 2 library calls 74948->75254 74949->74946 74952 6f2220 3 API calls 74949->74952 74951->74946 75152 682a58 75151->75152 75153 68298d 75151->75153 75220 6128f5 75219->75220 75221 612846 75219->75221 75223 612040 4 API calls 75220->75223 75222 612852 std::locale::_Locimp::_Locimp 75221->75222 75224 61287a 75221->75224 75227 6128b5 75221->75227 75228 6128be 75221->75228 75222->74937 75225 6128fa 75223->75225 75229 6ecd02 std::_Facet_Register 4 API calls 75224->75229 75236 611fa0 4 API calls 2 library calls 75225->75236 75227->75224 75227->75225 75231 6ecd02 std::_Facet_Register 4 API calls 75228->75231 75234 612896 std::locale::_Locimp::_Locimp 75228->75234 75230 61288d 75229->75230 75232 6f2220 3 API calls 75230->75232 75230->75234 75231->75234 75233 612904 75232->75233 75234->74937 75235->74936 75236->75230 75238 677aca 75237->75238 75239 6ecd02 std::_Facet_Register 4 API calls 75238->75239 75240 677b00 75239->75240 75241 63474f 75240->75241 75242 677b53 75240->75242 75243 677be9 75240->75243 75241->74343 75249 679480 4 API calls 2 library calls 75242->75249 75250 612b90 75243->75250 75247 677b59 75247->75241 75248 673850 4 API calls 75247->75248 75248->75247 75249->75247 75253 6eb15b 4 API calls 2 library calls 75250->75253 75254->74949 76259 677750 4 API calls 76258->76259 76260 635a83 76259->76260 76260->74404 76262 679b65 76261->76262 76262->76262 76263 679b9f 76262->76263 76264 679b7f 76262->76264 76265 612040 4 API calls 76263->76265 76266 67d790 4 API calls 76264->76266 76267 679ba4 76265->76267 76268 635b3d 76266->76268 76268->74410 76268->74411 76361->74419 76975->74577 76977 6fa8ba ___std_exception_copy 76976->76977 76993 6f74aa 76977->76993 76987 67cf51 76982->76987 76983 67d03f 77024 617d60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 76983->77024 76984 67cf9a 76985 6ecd02 std::_Facet_Register 4 API calls 76984->76985 76988 67cfb4 76985->76988 76987->76983 76987->76984 76991 67d008 76987->76991 76989 67d044 76991->74582 76992->74582 77009 6f6429 76993->77009 77010 6f642e 77009->77010 77011 6f6441 77009->77011 77024->76989 77026 675a60 4 API calls 77025->77026 77027 679b06 77026->77027 77027->74691 77033->74691 77034->74620 77041 675d50 4 API calls 77040->77041 77042 6408a0 77041->77042 77043 61b890 9 API calls 77042->77043 77044 6408ab 77043->77044 77164->74782 77166->74827 77168->74827 77623->74860 77624->74860 77628 66d0c0 77757 6521e0 77628->77757 77630 66d121 77630->77630 77631 66eb16 77630->77631 77632 66d178 77630->77632 77634 612040 4 API calls 77631->77634 77633 67d790 4 API calls 77632->77633 77635 66d1a1 CreateDirectoryA 77633->77635 77636 66eb1b 77634->77636 77643 66dd4f 77635->77643 77753 66d1cc std::locale::_Locimp::_Locimp __Mtx_unlock 77635->77753 77637 612040 4 API calls 77636->77637 77638 66eb20 77637->77638 77641 6f2220 3 API calls 77638->77641 77639 66e9d9 77640 66dd21 77644 675d50 4 API calls 77640->77644 77642 66eb25 77641->77642 79570 6ebf2b 8 API calls std::locale::_Setgloballocale 77642->79570 77646 66e99f 77643->77646 77650 66eb60 77643->77650 77651 66ddb8 77643->77651 77652 66dd32 77644->77652 77646->77639 77648 6f2220 3 API calls 77646->77648 77647 66eb2b 77649 612040 4 API calls 77647->77649 77672 66ebb4 77648->77672 77653 66eb30 77649->77653 77654 612040 4 API calls 77650->77654 77655 67d790 4 API calls 77651->77655 77652->77643 78346 61c000 77652->78346 77658 6f2220 3 API calls 77653->77658 77659 66eb65 77654->77659 77660 66dde1 CreateDirectoryA 77655->77660 77656 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77656->77753 77661 66eb35 77658->77661 77662 612040 4 API calls 77659->77662 77668 66e96c 77660->77668 77755 66de06 std::locale::_Locimp::_Locimp __Mtx_unlock 77660->77755 79571 6ebf2b 8 API calls std::locale::_Setgloballocale 77661->79571 77664 66eb6a 77662->77664 77667 6f2220 3 API calls 77664->77667 77665 66e93e 77670 675d50 4 API calls 77665->77670 77666 66eb3b 77671 612040 4 API calls 77666->77671 77673 66eb6f 77667->77673 77668->77646 77674 6f2220 3 API calls 77668->77674 77669 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77669->77755 77675 66e94f 77670->77675 77676 66eb40 77671->77676 77677 66ef23 77672->77677 77678 66ec5a 77672->77678 77726 66ed55 77672->77726 79574 6ebf2b 8 API calls std::locale::_Setgloballocale 77673->79574 77674->77646 78371 621370 77675->78371 77684 6f2220 3 API calls 77676->77684 77680 612040 4 API calls 77677->77680 77685 67d790 4 API calls 77678->77685 77687 66ef28 77680->77687 77682 66eda6 77689 67d790 4 API calls 77682->77689 77683 66ef32 77690 612040 4 API calls 77683->77690 77691 66eb45 77684->77691 77692 66ec80 77685->77692 77686 66eb75 77693 612040 4 API calls 77686->77693 77697 6f2220 3 API calls 77687->77697 77698 66edcc 77689->77698 77720 66ede3 77690->77720 79572 6ebf2b 8 API calls std::locale::_Setgloballocale 77691->79572 77694 66ecbe 77692->77694 79578 681030 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77692->79578 77695 66eb7a 77693->77695 79579 61c7d0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap ___std_exception_copy 77694->79579 77700 6f2220 3 API calls 77695->77700 77696 675ad0 4 API calls 77696->77753 77702 66ef2d 77697->77702 77704 675d50 4 API calls 77698->77704 77707 66eb7f 77700->77707 77709 6f2220 3 API calls 77702->77709 77710 66edde 77704->77710 77705 6f2220 3 API calls 77711 66ef3c 77705->77711 77706 66eb4b 77712 6f2220 3 API calls 77706->77712 79575 6ebf2b 8 API calls std::locale::_Setgloballocale 77707->79575 77709->77683 77713 66eb50 77712->77713 77717 612040 4 API calls 77713->77717 77715 66ecea 77715->77687 77721 66eb55 77717->77721 77718 66eb85 77722 612040 4 API calls 77718->77722 77720->77705 77723 66ee10 77720->77723 79573 6ebf2b 8 API calls std::locale::_Setgloballocale 77721->79573 77725 66eb8a 77722->77725 77728 6f2220 3 API calls 77725->77728 77726->77682 77726->77683 77727 66eb5b 77729 6f2220 3 API calls 77727->77729 77730 66eb8f 77728->77730 77729->77650 79576 6ebf2b 8 API calls std::locale::_Setgloballocale 77730->79576 77732 675ad0 4 API calls 77732->77755 77733 66eb95 77734 6f2220 3 API calls 77733->77734 77735 66eb9a 77734->77735 77736 612040 4 API calls 77735->77736 77737 66eb9f 77736->77737 79577 6ebf2b 8 API calls std::locale::_Setgloballocale 77737->79577 77739 66eba5 77740 6f2220 3 API calls 77739->77740 77740->77668 77741 67bb80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77741->77753 77742 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77742->77755 77743 67bb80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77743->77755 77744 6ec284 GetSystemTimePreciseAsFileTime 77744->77755 77745 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 77745->77753 77746 612830 4 API calls 77746->77753 77747 6ec284 GetSystemTimePreciseAsFileTime 77747->77753 77748 67d5a0 4 API calls 77748->77753 77749 612830 4 API calls 77749->77755 77750 675930 4 API calls 77750->77753 77751 67d5a0 4 API calls 77751->77755 77752 675930 4 API calls 77752->77755 77753->77636 77753->77638 77753->77640 77753->77642 77753->77647 77753->77653 77753->77656 77753->77661 77753->77666 77753->77676 77753->77691 77753->77696 77753->77706 77753->77713 77753->77721 77753->77727 77753->77741 77753->77745 77753->77746 77753->77747 77753->77748 77753->77750 79399 61f000 77753->79399 77755->77659 77755->77664 77755->77665 77755->77669 77755->77673 77755->77686 77755->77695 77755->77707 77755->77718 77755->77725 77755->77730 77755->77732 77755->77733 77755->77735 77755->77737 77755->77739 77755->77742 77755->77743 77755->77744 77755->77749 77755->77751 77755->77752 77756 61f000 14 API calls 77755->77756 77756->77755 77758 652202 77757->77758 77759 679a90 4 API calls 77758->77759 77760 6525b0 77758->77760 77762 65225d 77759->77762 77763 679a90 4 API calls 77760->77763 77764 653ace 77760->77764 77761 654eaf 77761->77630 77769 65226e CreateDirectoryA 77762->77769 77766 6525e5 77763->77766 77765 654c86 77764->77765 77767 679a90 4 API calls 77764->77767 77765->77761 77768 679a90 4 API calls 77765->77768 77774 6525fa CreateDirectoryA 77766->77774 77770 653b1f 77767->77770 77771 654cb9 77768->77771 77772 65259e 77769->77772 77773 65227a 77769->77773 77775 653b34 CreateDirectoryA 77770->77775 77781 654cce CreateDirectoryA 77771->77781 77776 612660 3 API calls 77772->77776 77785 679a90 4 API calls 77773->77785 77777 652607 77774->77777 77778 653abc 77774->77778 77779 654c74 77775->77779 77780 653b41 77775->77780 77776->77760 77787 679a90 4 API calls 77777->77787 77782 612660 3 API calls 77778->77782 77786 612660 3 API calls 77779->77786 77791 679a90 4 API calls 77780->77791 77783 654ea4 77781->77783 77784 654cdb 77781->77784 77782->77764 77788 612660 3 API calls 77783->77788 77793 679a90 4 API calls 77784->77793 77789 6522b8 77785->77789 77786->77765 77790 652646 77787->77790 77788->77761 77794 6522cb CreateDirectoryA 77789->77794 77795 65265a CreateDirectoryA 77790->77795 77792 653b7c 77791->77792 77801 653b8e CreateDirectoryA 77792->77801 77796 654d17 77793->77796 77797 6523d7 77794->77797 77798 6522dc __fread_nolock 77794->77798 77799 652665 77795->77799 77800 6527ba 77795->77800 77804 654d29 CreateDirectoryA 77796->77804 77806 679a90 4 API calls 77797->77806 77805 6522ee SHGetFolderPathA 77798->77805 77811 612700 4 API calls 77799->77811 77812 679a90 4 API calls 77800->77812 77802 653cbe 77801->77802 77803 653b9b 77801->77803 77815 679a90 4 API calls 77802->77815 77816 612700 4 API calls 77803->77816 77807 654e83 77804->77807 77834 654d36 77804->77834 77808 652328 77805->77808 77810 652409 77806->77810 77809 61c000 13 API calls 77807->77809 77814 654e96 77807->77814 77813 612700 4 API calls 77808->77813 77809->77814 77819 65241d CreateDirectoryA 77810->77819 77830 65269b 77811->77830 77817 6527f5 77812->77817 77818 652334 77813->77818 77822 612660 3 API calls 77814->77822 77820 653cfe 77815->77820 77832 653bec 77816->77832 77825 652809 CreateDirectoryA 77817->77825 77821 679bb0 4 API calls 77818->77821 77823 652570 77819->77823 77824 652428 __fread_nolock 77819->77824 77831 653d10 CreateDirectoryA 77820->77831 77828 65234a 77821->77828 77822->77783 77829 652585 77823->77829 77837 61c000 13 API calls 77823->77837 77836 65243b SHGetFolderPathA 77824->77836 77826 652814 77825->77826 77827 652c23 77825->77827 77847 612700 4 API calls 77826->77847 77849 679a90 4 API calls 77827->77849 77835 612660 3 API calls 77828->77835 77833 612660 3 API calls 77829->77833 77844 679bb0 4 API calls 77830->77844 77838 653d1d 77831->77838 77839 653e28 77831->77839 77846 679bb0 4 API calls 77832->77846 77840 652593 77833->77840 77841 612830 4 API calls 77834->77841 77842 65235c 77835->77842 77843 65247b 77836->77843 77837->77829 77852 612700 4 API calls 77838->77852 77855 679a90 4 API calls 77839->77855 77848 612660 3 API calls 77840->77848 77863 654dac 77841->77863 79580 61bf40 77842->79580 77850 612700 4 API calls 77843->77850 77845 6526ea 77844->77845 77851 612660 3 API calls 77845->77851 77853 653c2f 77846->77853 77870 652855 77847->77870 77848->77772 77854 652c5e 77849->77854 77857 652487 77850->77857 77858 6526fc 77851->77858 77876 653d56 77852->77876 77859 612660 3 API calls 77853->77859 77865 652c72 CreateDirectoryA 77854->77865 77856 653e52 77855->77856 77868 653e64 CreateDirectoryA 77856->77868 77861 679bb0 4 API calls 77857->77861 77875 612700 4 API calls 77858->77875 77862 653c41 77859->77862 77869 65249d 77861->77869 77882 61bf40 10 API calls 77862->77882 77877 679bb0 4 API calls 77863->77877 77866 652df0 77865->77866 77867 652c7d 77865->77867 77888 679a90 4 API calls 77866->77888 77887 612700 4 API calls 77867->77887 77872 653e71 77868->77872 77873 653f7e 77868->77873 77883 679bb0 4 API calls 77870->77883 77881 652714 77875->77881 77890 679bb0 4 API calls 77876->77890 77884 654df9 77877->77884 77889 61beb0 7 API calls 77881->77889 77891 653c53 77882->77891 77892 652898 77883->77892 77893 612660 3 API calls 77884->77893 77899 653d99 77890->77899 77901 612660 3 API calls 77892->77901 77902 654e0b 77893->77902 77926 61bf40 10 API calls 77902->77926 78347 6ec284 GetSystemTimePreciseAsFileTime 78346->78347 78348 61c033 78347->78348 78349 61c3c2 78348->78349 78350 61c03e 78348->78350 79710 6ebf2b 8 API calls std::locale::_Setgloballocale 78349->79710 78351 61c3c8 78350->78351 78354 67d790 4 API calls 78350->78354 78353 612040 4 API calls 78351->78353 78355 61c09c FindFirstFileA 78354->78355 79711 6eef60 78371->79711 79400 61f086 79399->79400 79401 61f604 79400->79401 79402 67d790 4 API calls 79400->79402 79403 612040 4 API calls 79401->79403 79449 61f0d9 __Mtx_unlock 79402->79449 79404 61f609 79403->79404 81089 6ebf2b 8 API calls std::locale::_Setgloballocale 79404->81089 79406 6f2220 3 API calls 79409 61f614 __fread_nolock 79406->79409 79407 675a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 79407->79449 79408 61f5e8 79408->77753 79410 612830 4 API calls 79409->79410 79411 61f6e9 79410->79411 79413 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 79413->79449 79422 675bd0 ExitProcess RtlAllocateHeap RtlFreeHeap 79422->79449 79429 6ec284 GetSystemTimePreciseAsFileTime 79429->79449 79434 61f485 79434->79406 79434->79408 79449->79401 79449->79404 79449->79407 79449->79413 79449->79422 79449->79429 79449->79434 79452 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 79449->79452 79456 61f000 13 API calls 79449->79456 79452->79449 79456->79449 79578->77694 79579->77715 79581 6ec284 GetSystemTimePreciseAsFileTime 79580->79581 81098 678da0 81099 678db7 81098->81099 81100 678dc7 81098->81100 81099->81100 81101 6f2220 3 API calls 81099->81101 81102 678ddc 81101->81102 81103 678e78 81102->81103 81110 6ec033 81102->81110 81107 678e22 81121 67ae90 5 API calls 6 library calls 81107->81121 81109 678e42 81111 6ebf8f 81110->81111 81113 6f2dc5 3 API calls 81111->81113 81114 6ebfe8 81111->81114 81119 678e11 81111->81119 81113->81114 81118 6ebfef 81114->81118 81122 6f2dc5 81114->81122 81115 6ec00c 81116 6f6ba6 6 API calls 81115->81116 81115->81119 81116->81118 81117 6f6658 7 API calls 81117->81119 81118->81117 81118->81119 81119->81103 81120 677d20 ExitProcess RtlAllocateHeap RtlFreeHeap 81119->81120 81120->81107 81121->81109 81125 6f2d0e __fread_nolock 81122->81125 81123 6f2d21 81136 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 81123->81136 81125->81123 81127 6f2d41 81125->81127 81126 6f2d26 81137 6f2210 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 81126->81137 81128 6f2d46 81127->81128 81129 6f2d53 81127->81129 81138 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 81128->81138 81132 7040f8 2 API calls 81129->81132 81133 6f2d5c 81132->81133 81135 6f2d31 81133->81135 81139 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 81133->81139 81135->81115 81136->81126 81137->81135 81138->81135 81139->81135 81140 50c041e 81141 50c0428 Process32NextW 81140->81141 81142 50c042d 81140->81142 81141->81142 81143 65f0d0 81144 65f0f6 81143->81144 81145 65f121 81144->81145 81146 66327b 81144->81146 81217 612700 4 API calls 81144->81217 81220 63de10 15 API calls 81144->81220 81147 675d50 4 API calls 81145->81147 81148 675d50 4 API calls 81145->81148 81147->81145 81149 65f165 81148->81149 81150 65f1ab 81149->81150 81152 65f1bc 81150->81152 81151 612830 4 API calls 81151->81152 81152->81151 81153 612830 4 API calls 81152->81153 81154 65f23b 81153->81154 81156 662e02 81154->81156 81157 65f263 81154->81157 82058 63de10 81154->82058 81158 675d50 4 API calls 81156->81158 81161 65f275 81157->81161 81159 662e23 81158->81159 81160 675d50 4 API calls 81159->81160 81167 662e3f 81160->81167 81162 65f291 81161->81162 81163 675d50 4 API calls 81162->81163 81164 65f299 81163->81164 81166 65f2b0 81164->81166 81165 612830 4 API calls 81165->81167 81168 65f2b7 81166->81168 81167->81165 81171 662ee0 81167->81171 81169 675d50 4 API calls 81168->81169 81170 65f2bf 81169->81170 81173 612700 4 API calls 81170->81173 81171->81171 81172 612830 4 API calls 81171->81172 81174 662f1d 81172->81174 81175 65f2f9 81173->81175 81176 63de10 15 API calls 81174->81176 81178 675d50 4 API calls 81174->81178 81177 612700 4 API calls 81175->81177 81176->81174 81183 662f56 81178->81183 81181 675d50 4 API calls 81181->81183 81183->81181 81184 662fa0 81183->81184 81191 662fbb 81184->81191 81217->81144 81220->81144 82059 63de6e __fread_nolock 82058->82059 82060 679b50 4 API calls 82059->82060 82061 63dea5 82060->82061 82062 63eb59 82061->82062 82063 63decd 82061->82063 82064 612700 4 API calls 82062->82064 82065 675d50 4 API calls 82063->82065 82066 63eb69 82064->82066 82067 63dede 82065->82067 82116 6749f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82066->82116 82069 630720 15 API calls 82067->82069 82071 63dee9 82069->82071 82070 63eb7f 82072 612660 3 API calls 82070->82072 82074 63defc 82071->82074 82106 63df1c std::locale::_Locimp::_Locimp 82071->82106 82073 63eb57 82072->82073 82077 612700 4 API calls 82073->82077 82114 63ebe4 std::locale::_Locimp::_Locimp 82073->82114 82075 677f40 5 API calls 82074->82075 82076 63eb4b 82089 63fce6 82093 612040 4 API calls 82089->82093 82090 6f2220 3 API calls 82091 63df17 82091->82090 82092 63fcc9 82091->82092 82092->81154 82093->82091 82095 679a90 4 API calls 82095->82106 82097 675a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82097->82106 82099 675ad0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82099->82106 82100 679cb0 4 API calls 82100->82106 82103 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82103->82106 82104 67bb80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82104->82106 82105 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82105->82106 82106->82076 82106->82089 82106->82091 82106->82095 82106->82097 82106->82099 82106->82100 82106->82103 82106->82104 82106->82105 82108 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82106->82108 82112 61beb0 7 API calls 82106->82112 82115 682a60 4 API calls 3 library calls 82106->82115 82108->82106 82112->82106 82114->82089 82114->82091 82115->82106 82116->82070 82118 663850 82119 663890 82118->82119 82120 679a90 4 API calls 82119->82120 82121 6645bb 82119->82121 82123 664dce 82119->82123 82122 6638f9 82120->82122 82124 679a90 4 API calls 82121->82124 82127 61bf40 10 API calls 82122->82127 82129 679a90 4 API calls 82123->82129 82132 664f64 82123->82132 82126 664602 82124->82126 82125 6650dc 82303 672500 ExitProcess RtlAllocateHeap RtlFreeHeap 82125->82303 82133 6f2dd0 3 API calls 82126->82133 82137 663912 82127->82137 82131 664e4c 82129->82131 82130 6650ea 82141 6f2dd0 3 API calls 82131->82141 82132->82125 82135 679a90 4 API calls 82132->82135 82134 664616 82133->82134 82136 612660 3 API calls 82134->82136 82139 664ff1 82135->82139 82147 664629 82136->82147 82138 66392a 82137->82138 82233 61bfc0 82137->82233 82145 6645a9 82138->82145 82149 663f9c 82138->82149 82241 67a0f0 82138->82241 82146 6f2dd0 3 API calls 82139->82146 82143 664e60 82141->82143 82144 612660 3 API calls 82143->82144 82157 664e73 82144->82157 82148 612660 3 API calls 82145->82148 82151 665005 82146->82151 82147->82123 82152 612be0 6 API calls 82147->82152 82148->82121 82150 664588 82149->82150 82153 67a0f0 4 API calls 82149->82153 82150->82145 82156 61c000 13 API calls 82150->82156 82155 612660 3 API calls 82151->82155 82160 664642 82152->82160 82203 663fc8 82153->82203 82154 663f8d 82249 62c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 82154->82249 82162 665018 82155->82162 82156->82145 82157->82132 82159 612be0 6 API calls 82157->82159 82184 664e8c 82159->82184 82163 67a0f0 4 API calls 82160->82163 82168 6649f8 82160->82168 82161 664579 82252 62c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 82161->82252 82162->82125 82165 612be0 6 API calls 82162->82165 82201 664668 82163->82201 82164 664f5e 82167 6f6658 7 API calls 82164->82167 82179 665031 82165->82179 82167->82132 82169 664dc8 82168->82169 82255 67d050 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 82168->82255 82170 6f6658 7 API calls 82169->82170 82170->82123 82172 664a1f 82256 689b20 82172->82256 82173 6650d6 82175 6f6658 7 API calls 82173->82175 82175->82125 82176 6649e9 82254 62c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 82176->82254 82179->82173 82185 612be0 6 API calls 82179->82185 82180 672aa0 4 API calls 82229 66395a 82180->82229 82184->82164 82186 612be0 6 API calls 82184->82186 82185->82179 82186->82184 82187 672aa0 4 API calls 82187->82203 82188 612700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82188->82229 82190 672aa0 4 API calls 82190->82201 82193 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82193->82203 82194 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82194->82229 82195 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82195->82201 82196 680e30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82196->82229 82198 679b50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82198->82229 82199 680e30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82199->82203 82201->82176 82201->82190 82201->82195 82205 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82201->82205 82208 680e30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82201->82208 82211 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82201->82211 82216 612be0 6 API calls 82201->82216 82253 677270 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 82201->82253 82202 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82202->82203 82203->82161 82203->82187 82203->82193 82203->82199 82203->82202 82207 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82203->82207 82215 61bfc0 10 API calls 82203->82215 82217 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82203->82217 82218 679b50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82203->82218 82222 61bf40 10 API calls 82203->82222 82223 61beb0 7 API calls 82203->82223 82227 6f2dd0 ExitProcess RtlAllocateHeap RtlFreeHeap 82203->82227 82230 612be0 6 API calls 82203->82230 82232 6f6658 7 API calls 82203->82232 82250 677270 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 82203->82250 82251 678670 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::locale::_Locimp::_Locimp 82203->82251 82204 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82204->82229 82205->82201 82207->82203 82208->82201 82211->82201 82214 61beb0 7 API calls 82214->82229 82215->82203 82216->82201 82217->82203 82218->82203 82220 6f2dd0 ExitProcess RtlAllocateHeap RtlFreeHeap 82220->82229 82222->82203 82223->82203 82224 612be0 6 API calls 82224->82229 82225 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82225->82229 82226 61bf40 10 API calls 82226->82229 82227->82203 82228 61bfc0 10 API calls 82228->82229 82229->82154 82229->82180 82229->82188 82229->82194 82229->82196 82229->82198 82229->82204 82229->82214 82229->82220 82229->82224 82229->82225 82229->82226 82229->82228 82231 6f6658 7 API calls 82229->82231 82246 677270 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 82229->82246 82247 61c6e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82229->82247 82248 678670 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::locale::_Locimp::_Locimp 82229->82248 82230->82203 82231->82229 82232->82203 82234 6ec284 GetSystemTimePreciseAsFileTime 82233->82234 82235 61bfcd 82234->82235 82236 61bfd4 CreateDirectoryA 82235->82236 82237 61bfef 82235->82237 82238 61bfe8 __Mtx_unlock 82236->82238 82304 6ebf2b 8 API calls std::locale::_Setgloballocale 82237->82304 82238->82138 82242 6ecd02 std::_Facet_Register 4 API calls 82241->82242 82243 67a134 82242->82243 82244 689b20 4 API calls 82243->82244 82245 67a15e 82244->82245 82245->82229 82246->82229 82247->82229 82248->82229 82249->82149 82250->82203 82251->82203 82252->82150 82253->82201 82254->82168 82255->82172 82257 689b5f 82256->82257 82258 689d16 82256->82258 82259 6ecd02 std::_Facet_Register 4 API calls 82257->82259 82260 612700 4 API calls 82258->82260 82284 689b74 82259->82284 82261 689d24 82260->82261 82262 679bb0 4 API calls 82261->82262 82264 689d39 82262->82264 82263 689caf 82265 689cc9 82263->82265 82306 67bdb0 82263->82306 82267 618920 4 API calls 82264->82267 82269 67bdb0 3 API calls 82265->82269 82266 673850 4 API calls 82266->82284 82270 689d4e Concurrency::cancel_current_task 82267->82270 82273 6f2220 3 API calls 82270->82273 82272 675d50 4 API calls 82272->82284 82275 689d64 82273->82275 82284->82263 82284->82266 82284->82270 82284->82272 82305 68e210 4 API calls 2 library calls 82284->82305 82303->82130 82305->82284 82309 67bdc3 82306->82309 82310 67bdf3 82306->82310 82309->82310 82310->82265 82326 6651f0 82621 665233 __Mtx_unlock 82326->82621 82327 66524b 82328 679a90 4 API calls 82327->82328 82330 667364 82328->82330 82329 679a90 4 API calls 82329->82621 82331 61bf40 10 API calls 82330->82331 82333 66737d 82331->82333 82332 61bf40 10 API calls 82332->82621 82334 66738e CreateDirectoryA 82333->82334 82335 66739d 82333->82335 82334->82335 82337 667f93 82334->82337 82336 667f78 82335->82336 82338 67a0f0 4 API calls 82335->82338 82336->82337 82340 61c000 13 API calls 82336->82340 82339 612660 3 API calls 82337->82339 82527 6673c5 __Mtx_unlock 82338->82527 82341 667fa1 82339->82341 82340->82337 82342 667f69 82748 62c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 82342->82748 82343 67a0f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82343->82621 82346 668207 82347 6f2220 3 API calls 82346->82347 82349 66820c 82347->82349 82348 61c000 13 API calls 82348->82621 82750 6ebf2b 8 API calls std::locale::_Setgloballocale 82349->82750 82351 67bdb0 ExitProcess RtlAllocateHeap RtlFreeHeap 82351->82621 82352 668212 82353 612040 4 API calls 82352->82353 82354 668217 82353->82354 82355 6f2220 3 API calls 82354->82355 82359 66821c 82355->82359 82356 672990 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82356->82527 82357 672aa0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82357->82621 82358 67a0f0 4 API calls 82358->82527 82360 66a3d7 82359->82360 82361 6682f8 82359->82361 82365 612040 4 API calls 82360->82365 82362 67d790 4 API calls 82361->82362 82366 668321 82362->82366 82363 6ecd02 std::_Facet_Register 4 API calls 82363->82621 82364 67bdb0 3 API calls 82364->82527 82367 66a3dc 82365->82367 82369 6ec284 GetSystemTimePreciseAsFileTime 82366->82369 82751 6ebf2b 8 API calls std::locale::_Setgloballocale 82367->82751 82372 66834e 82369->82372 82370 689b20 4 API calls 82370->82621 82372->82367 82374 668359 82372->82374 82376 668379 __Mtx_unlock 82374->82376 82381 66836d GetFileAttributesA 82374->82381 82381->82376 82382 6681ee Concurrency::cancel_current_task 82385 612040 4 API calls 82382->82385 82385->82346 82386 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82386->82527 82389 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82389->82527 82391 679b50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82391->82527 82395 66813a Concurrency::cancel_current_task 82402 612040 4 API calls 82395->82402 82397 675a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82397->82527 82398 6ec284 GetSystemTimePreciseAsFileTime 82398->82527 82399 612700 4 API calls 82399->82527 82406 668153 82402->82406 82403 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82403->82621 82404 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82404->82527 82749 6ebf2b 8 API calls std::locale::_Setgloballocale 82406->82749 82411 679b50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82411->82621 82413 668159 82417 612040 4 API calls 82413->82417 82415 6f2dd0 3 API calls 82415->82527 82422 66815e 82417->82422 82419 61bf40 10 API calls 82419->82527 82420 675ad0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82420->82621 82436 612700 4 API calls 82422->82436 82425 612700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82425->82621 82426 6ec284 GetSystemTimePreciseAsFileTime 82426->82621 82442 66816f 82436->82442 82448 679bb0 4 API calls 82442->82448 82443 67d5a0 4 API calls 82443->82527 82447 6f2dd0 ExitProcess RtlAllocateHeap RtlFreeHeap 82447->82621 82453 668184 82448->82453 82451 679af0 4 API calls 82451->82621 82459 618920 4 API calls 82453->82459 82454 61bfc0 10 API calls 82454->82621 82458 672990 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82458->82621 82472 66819c Concurrency::cancel_current_task 82459->82472 82461 675ad0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82461->82527 82462 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82462->82621 82467 6f6658 7 API calls 82467->82621 82469 67d5a0 4 API calls 82469->82621 82478 612700 4 API calls 82472->82478 82474 675a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82474->82621 82476 6f6658 7 API calls 82476->82527 82477 672aa0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82477->82527 82482 6681c1 82478->82482 82484 679bb0 4 API calls 82482->82484 82490 6681d6 82484->82490 82487 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82487->82621 82494 618920 4 API calls 82490->82494 82494->82382 82516 680e30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82516->82621 82519 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82519->82527 82525 680e30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82525->82527 82526 612be0 6 API calls 82526->82527 82527->82342 82527->82346 82527->82349 82527->82352 82527->82354 82527->82356 82527->82358 82527->82364 82527->82382 82527->82386 82527->82389 82527->82391 82527->82397 82527->82398 82527->82399 82527->82404 82527->82415 82527->82419 82527->82443 82527->82461 82527->82476 82527->82477 82527->82519 82527->82525 82527->82526 82561 680790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82561->82621 82562 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82562->82621 82569 6680aa 82580 612700 4 API calls 82569->82580 82586 6680bb 82580->82586 82588 679bb0 4 API calls 82586->82588 82591 6680d0 82588->82591 82596 618920 4 API calls 82591->82596 82600 6680e8 Concurrency::cancel_current_task 82596->82600 82602 612700 4 API calls 82600->82602 82605 66810d 82602->82605 82606 679bb0 4 API calls 82605->82606 82607 668122 82606->82607 82609 618920 4 API calls 82607->82609 82609->82395 82621->82327 82621->82329 82621->82332 82621->82343 82621->82346 82621->82348 82621->82351 82621->82357 82621->82363 82621->82370 82621->82395 82621->82403 82621->82406 82621->82411 82621->82413 82621->82420 82621->82422 82621->82425 82621->82426 82621->82447 82621->82451 82621->82454 82621->82458 82621->82462 82621->82467 82621->82469 82621->82472 82621->82474 82621->82487 82621->82516 82621->82561 82621->82562 82621->82569 82621->82600 82625 612be0 6 API calls 82621->82625 82744 679d10 82621->82744 82747 62c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 82621->82747 82625->82621 82745 67d5a0 4 API calls 82744->82745 82746 679d28 82745->82746 82746->82621 82747->82621 82748->82336 82776 663290 82785 6632b6 82776->82785 82777 663836 82778 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82778->82785 82780 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82780->82785 82781 673450 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82781->82785 82785->82777 82785->82778 82785->82780 82785->82781 82787 673850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82785->82787 82788 644880 82785->82788 82918 646530 82785->82918 83037 6475f0 82785->83037 83159 648c20 82785->83159 83272 64a690 82785->83272 82787->82785 82789 6448b6 82788->82789 82790 673bc0 4 API calls 82789->82790 82791 6448d7 82790->82791 82792 673b90 4 API calls 82791->82792 82793 644900 82792->82793 82794 679e00 4 API calls 82793->82794 82795 644925 __fread_nolock 82794->82795 82796 679b50 4 API calls 82795->82796 82797 644970 82796->82797 82798 679a90 4 API calls 82797->82798 82799 6449c2 82798->82799 83388 5120b32 82799->83388 83394 5120e12 GetPrivateProfileStringA 82799->83394 83396 5120db0 82799->83396 83400 5120df0 82799->83400 83404 5120d5b 82799->83404 83408 5120d9a 82799->83408 83412 5120d5e 82799->83412 83416 5120dd9 82799->83416 83420 5120d82 82799->83420 83424 5120d1f 82799->83424 83430 5120d67 82799->83430 83434 5120e03 82799->83434 83437 5120dc5 82799->83437 82801 6f2220 3 API calls 82802 646435 82801->82802 82805 612700 4 API calls 82802->82805 82803 6462d0 82803->82801 82804 64640d 82803->82804 82804->82785 82806 64644c 82805->82806 82807 679bb0 4 API calls 82806->82807 82809 612660 ExitProcess RtlAllocateHeap RtlFreeHeap 82857 6449e6 __fread_nolock __Mtx_unlock 82809->82857 82811 646479 Concurrency::cancel_current_task 82812 612700 4 API calls 82811->82812 82813 6464a4 82812->82813 82814 679bb0 4 API calls 82813->82814 82817 6464d1 Concurrency::cancel_current_task 83821 6ebf2b 8 API calls std::locale::_Setgloballocale 82817->83821 82819 679a90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82819->82857 82820 675d50 4 API calls 82820->82857 82821 6464eb 82822 612040 4 API calls 82821->82822 82824 6464f0 82822->82824 82823 61b890 9 API calls 82823->82857 82825 6244f0 14 API calls 82825->82857 82826 67a190 5 API calls 82826->82857 82828 624920 10 API calls 82828->82857 82829 672990 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82829->82857 82831 672aa0 4 API calls 82831->82857 82832 6af7d0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82832->82857 82833 673850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82833->82857 82834 67d790 4 API calls 82834->82857 82835 6aefc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82835->82857 82836 6ec284 GetSystemTimePreciseAsFileTime 82836->82857 82837 673bc0 4 API calls 82837->82857 82839 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82839->82857 82840 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82840->82857 82841 679cb0 4 API calls 82841->82857 82842 67a690 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82842->82857 82843 679af0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82843->82857 82844 61bf40 10 API calls 82844->82857 82845 679bb0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82845->82857 82846 61beb0 7 API calls 82846->82857 82847 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82847->82857 82848 67cf10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82848->82857 82849 679f40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82849->82857 82850 6f2dd0 ExitProcess RtlAllocateHeap RtlFreeHeap 82850->82857 82851 612700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82851->82857 82852 6ecd02 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 82852->82857 82853 6f6658 7 API calls 82853->82857 82854 673580 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82854->82857 82855 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82855->82857 82856 6fabd8 6 API calls 82856->82857 82857->82802 82857->82803 82857->82809 82857->82811 82857->82817 82857->82819 82857->82820 82857->82821 82857->82823 82857->82825 82857->82826 82857->82828 82857->82829 82857->82831 82857->82832 82857->82833 82857->82834 82857->82835 82857->82836 82857->82837 82857->82839 82857->82840 82857->82841 82857->82842 82857->82843 82857->82844 82857->82845 82857->82846 82857->82847 82857->82848 82857->82849 82857->82850 82857->82851 82857->82852 82857->82853 82857->82854 82857->82855 82857->82856 83441 6fa55e 82857->83441 83455 50d0734 82857->83455 83467 50d08f4 82857->83467 83473 50d083a 82857->83473 83481 50d084d 82857->83481 83489 50d06ba 82857->83489 83501 50d0bbe 82857->83501 83505 50d093a 82857->83505 83511 50d06fa 82857->83511 83523 50d08e7 82857->83523 83529 50d0723 82857->83529 83541 50d0929 82857->83541 83547 50d090e 82857->83547 83553 50d0b6c 82857->83553 83557 50d0a7a 82857->83557 83563 50d0a4f 82857->83563 83569 50d074b 82857->83569 83581 50d09ad 82857->83581 83587 50d082d 82857->83587 83595 50d0712 82857->83595 83607 50d07b1 82857->83607 83619 50d0b96 82857->83619 83623 50d0976 82857->83623 83629 50d0bf0 82857->83629 83633 50d078c 82857->83633 83645 50d06da 82857->83645 83657 50d0b32 82857->83657 83663 50d0b0a 82857->83663 83669 50d0780 82857->83669 83681 50d0ac1 82857->83681 83687 50d0882 82857->83687 83693 50d0900 82857->83693 83699 50d09df 82857->83699 83705 50d0b42 82857->83705 83711 50d099a 82857->83711 83717 50d09f3 82857->83717 83723 50d0a95 82857->83723 83729 50d0955 82857->83729 83735 50d08d1 82857->83735 83741 50d07c7 82857->83741 83752 50d0a12 82857->83752 83758 50d068d 82857->83758 83770 50d0bab 82857->83770 83774 50d08af 82857->83774 83780 50d09c1 82857->83780 83786 50d076c 82857->83786 83798 50d0aad 82857->83798 83804 50d06f0 82857->83804 83816 6d27d0 82857->83816 83819 67a7a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 82857->83819 83820 6aeeb0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82857->83820 82919 646566 82918->82919 82920 677750 4 API calls 82919->82920 82921 64658b 82920->82921 82922 673b90 4 API calls 82921->82922 82923 6465b0 82922->82923 82924 679e00 4 API calls 82923->82924 82925 6465ec __fread_nolock 82924->82925 82925->82925 82926 647530 82925->82926 82928 67d790 4 API calls 82925->82928 82927 612040 4 API calls 82926->82927 82929 647535 82927->82929 82931 64668f 82928->82931 82930 612040 4 API calls 82929->82930 82945 64745c 82930->82945 82931->82929 82931->82931 82934 67d790 4 API calls 82931->82934 82932 6f2220 3 API calls 82933 64753f 82932->82933 82936 612700 4 API calls 82933->82936 82935 64671f 82934->82935 83024 5120e12 GetPrivateProfileStringA 82935->83024 83025 5120b32 2 API calls 82935->83025 83026 5120db0 GetPrivateProfileStringA 82935->83026 83027 5120df0 GetPrivateProfileStringA 82935->83027 83028 5120d9a GetPrivateProfileStringA 82935->83028 83029 5120d5b GetPrivateProfileStringA 82935->83029 83030 5120dd9 GetPrivateProfileStringA 82935->83030 83031 5120d5e GetPrivateProfileStringA 82935->83031 83032 5120d1f 2 API calls 82935->83032 83033 5120d82 GetPrivateProfileStringA 82935->83033 83034 5120e03 GetPrivateProfileStringA 82935->83034 83035 5120d67 GetPrivateProfileStringA 82935->83035 83036 5120dc5 GetPrivateProfileStringA 82935->83036 82937 647556 82936->82937 82938 679bb0 4 API calls 82937->82938 82939 64756b 82938->82939 82941 6fa55e 4 API calls 82953 646751 __fread_nolock 82941->82953 82942 647583 Concurrency::cancel_current_task 82943 612700 4 API calls 82942->82943 82944 6475ab 82943->82944 82946 679bb0 4 API calls 82944->82946 82945->82932 82949 64750d 82945->82949 82947 6475c0 82946->82947 82949->82785 82951 675a60 4 API calls 82951->82953 82952 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82952->82953 82953->82926 82953->82933 82953->82941 82953->82942 82953->82945 82953->82951 82953->82952 82954 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82954 82955 6f2dd0 3 API calls 82953->82955 82956 61c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82956 82957 6f6658 7 API calls 82953->82957 82958 675930 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82958 82959 677f40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 82953->82959 82960 673b90 4 API calls 82953->82960 82961 6ecd02 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 82953->82961 82963 6244f0 14 API calls 82953->82963 82964 6d2690 3 API calls 82953->82964 82965 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82965 82966 624920 10 API calls 82953->82966 82967 6aefc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82953->82967 82969 6adfd0 3 API calls 82953->82969 82970 6abe90 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82953->82970 82971 69d970 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82953->82971 82972 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82972 82973 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82973 82974 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 82953->82974 82975 67cf10 4 API calls 82953->82975 82977 50d068d 4 API calls 82953->82977 82978 50d084d 3 API calls 82953->82978 82979 50d078c 4 API calls 82953->82979 82980 50d0a4f 2 API calls 82953->82980 82981 50d090e 2 API calls 82953->82981 82982 50d074b 4 API calls 82953->82982 82983 50d0b0a 2 API calls 82953->82983 82984 50d07c7 4 API calls 82953->82984 82985 50d09c1 2 API calls 82953->82985 82986 50d0ac1 2 API calls 82953->82986 82987 50d0780 4 API calls 82953->82987 82988 50d0900 2 API calls 82953->82988 82989 50d0882 2 API calls 82953->82989 82990 50d0b42 2 API calls 82953->82990 82991 50d09df 2 API calls 82953->82991 82992 50d06da 4 API calls 82953->82992 82993 50d099a 2 API calls 82953->82993 82994 50d0955 2 API calls 82953->82994 82995 50d0a95 2 API calls 82953->82995 82996 50d0b96 BaseDllReadWriteIniFile 82953->82996 82997 50d08d1 2 API calls 82953->82997 82998 50d0712 4 API calls 82953->82998 82999 50d0a12 2 API calls 82953->82999 83000 50d09ad 2 API calls 82953->83000 83001 50d082d 3 API calls 82953->83001 83002 50d0aad 2 API calls 82953->83002 83003 50d076c 4 API calls 82953->83003 83004 50d0b6c BaseDllReadWriteIniFile 82953->83004 83005 50d08af 2 API calls 82953->83005 83006 50d0929 2 API calls 82953->83006 83007 50d0bab BaseDllReadWriteIniFile 82953->83007 83008 50d08e7 2 API calls 82953->83008 83009 50d0723 4 API calls 82953->83009 83010 50d0bbe BaseDllReadWriteIniFile 82953->83010 83011 50d06ba 4 API calls 82953->83011 83012 50d06fa 4 API calls 82953->83012 83013 50d093a 2 API calls 82953->83013 83014 50d083a 3 API calls 82953->83014 83015 50d0a7a 2 API calls 82953->83015 83016 50d0734 4 API calls 82953->83016 83017 50d08f4 2 API calls 82953->83017 83018 50d0976 2 API calls 82953->83018 83019 50d07b1 4 API calls 82953->83019 83020 50d06f0 4 API calls 82953->83020 83021 50d0bf0 BaseDllReadWriteIniFile 82953->83021 83022 50d09f3 2 API calls 82953->83022 83023 50d0b32 2 API calls 82953->83023 83827 677920 82953->83827 83839 673450 82953->83839 83855 6addc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 82953->83855 82954->82953 82955->82953 82956->82953 82957->82953 82958->82953 82959->82953 82960->82953 82961->82953 82963->82953 82964->82953 82965->82953 82966->82953 82967->82953 82969->82953 82970->82953 82971->82953 82972->82953 82973->82953 82974->82953 82975->82953 82977->82953 82978->82953 82979->82953 82980->82953 82981->82953 82982->82953 82983->82953 82984->82953 82985->82953 82986->82953 82987->82953 82988->82953 82989->82953 82990->82953 82991->82953 82992->82953 82993->82953 82994->82953 82995->82953 82996->82953 82997->82953 82998->82953 82999->82953 83000->82953 83001->82953 83002->82953 83003->82953 83004->82953 83005->82953 83006->82953 83007->82953 83008->82953 83009->82953 83010->82953 83011->82953 83012->82953 83013->82953 83014->82953 83015->82953 83016->82953 83017->82953 83018->82953 83019->82953 83020->82953 83021->82953 83022->82953 83023->82953 83024->82953 83025->82953 83026->82953 83027->82953 83028->82953 83029->82953 83030->82953 83031->82953 83032->82953 83033->82953 83034->82953 83035->82953 83036->82953 83038 647626 83037->83038 83039 677750 4 API calls 83038->83039 83040 64764b 83039->83040 83041 673b90 4 API calls 83040->83041 83042 647673 83041->83042 83043 679e00 4 API calls 83042->83043 83044 6476b8 __fread_nolock 83043->83044 83044->83044 83045 648b1f 83044->83045 83046 67d790 4 API calls 83044->83046 83047 612040 4 API calls 83045->83047 83051 647770 83046->83051 83048 648b24 83047->83048 83049 612040 4 API calls 83048->83049 83069 648a47 83049->83069 83050 6f2220 3 API calls 83052 648b2e 83050->83052 83051->83048 83051->83051 83055 67d790 4 API calls 83051->83055 83858 679310 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83052->83858 83054 648b33 83057 612700 4 API calls 83054->83057 83056 6477ff 83055->83056 83146 5120e12 GetPrivateProfileStringA 83056->83146 83147 5120b32 2 API calls 83056->83147 83148 5120db0 GetPrivateProfileStringA 83056->83148 83149 5120df0 GetPrivateProfileStringA 83056->83149 83150 5120d9a GetPrivateProfileStringA 83056->83150 83151 5120d5b GetPrivateProfileStringA 83056->83151 83152 5120dd9 GetPrivateProfileStringA 83056->83152 83153 5120d5e GetPrivateProfileStringA 83056->83153 83154 5120d1f 2 API calls 83056->83154 83155 5120d82 GetPrivateProfileStringA 83056->83155 83156 5120e03 GetPrivateProfileStringA 83056->83156 83157 5120d67 GetPrivateProfileStringA 83056->83157 83158 5120dc5 GetPrivateProfileStringA 83056->83158 83058 648b4a 83057->83058 83059 679bb0 4 API calls 83058->83059 83060 648b5f 83059->83060 83061 6fa55e 4 API calls 83098 647831 __fread_nolock 83061->83098 83063 648b77 Concurrency::cancel_current_task 83064 612700 4 API calls 83063->83064 83065 648ba2 83064->83065 83066 679bb0 4 API calls 83065->83066 83068 648bb7 83066->83068 83067 648afc 83067->82785 83069->83050 83069->83067 83072 675a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83072->83098 83073 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83073->83098 83074 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83074->83098 83075 6f2dd0 3 API calls 83075->83098 83076 61c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83076->83098 83077 6f6658 7 API calls 83077->83098 83078 677f40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 83078->83098 83079 675930 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83079->83098 83080 673b90 4 API calls 83080->83098 83081 6ecd02 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 83081->83098 83082 677920 4 API calls 83082->83098 83083 6244f0 14 API calls 83083->83098 83084 6d2690 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83084->83098 83085 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83085->83098 83086 624920 10 API calls 83086->83098 83087 6aefc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83087->83098 83089 6adfd0 3 API calls 83089->83098 83090 6abe90 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83090->83098 83091 679bb0 4 API calls 83091->83098 83092 69d970 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83092->83098 83093 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83093->83098 83094 67cf10 4 API calls 83094->83098 83095 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83095->83098 83096 673450 4 API calls 83096->83098 83097 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83097->83098 83098->83045 83098->83052 83098->83054 83098->83061 83098->83063 83098->83069 83098->83072 83098->83073 83098->83074 83098->83075 83098->83076 83098->83077 83098->83078 83098->83079 83098->83080 83098->83081 83098->83082 83098->83083 83098->83084 83098->83085 83098->83086 83098->83087 83098->83089 83098->83090 83098->83091 83098->83092 83098->83093 83098->83094 83098->83095 83098->83096 83098->83097 83099 50d068d 4 API calls 83098->83099 83100 50d084d 3 API calls 83098->83100 83101 50d078c 4 API calls 83098->83101 83102 50d0a4f 2 API calls 83098->83102 83103 50d090e 2 API calls 83098->83103 83104 50d074b 4 API calls 83098->83104 83105 50d0b0a 2 API calls 83098->83105 83106 50d07c7 4 API calls 83098->83106 83107 50d09c1 2 API calls 83098->83107 83108 50d0ac1 2 API calls 83098->83108 83109 50d0780 4 API calls 83098->83109 83110 50d0900 2 API calls 83098->83110 83111 50d0882 2 API calls 83098->83111 83112 50d0b42 2 API calls 83098->83112 83113 50d09df 2 API calls 83098->83113 83114 50d06da 4 API calls 83098->83114 83115 50d099a 2 API calls 83098->83115 83116 50d0955 2 API calls 83098->83116 83117 50d0a95 2 API calls 83098->83117 83118 50d0b96 BaseDllReadWriteIniFile 83098->83118 83119 50d08d1 2 API calls 83098->83119 83120 50d0712 4 API calls 83098->83120 83121 50d0a12 2 API calls 83098->83121 83122 50d09ad 2 API calls 83098->83122 83123 50d082d 3 API calls 83098->83123 83124 50d0aad 2 API calls 83098->83124 83125 50d076c 4 API calls 83098->83125 83126 50d0b6c BaseDllReadWriteIniFile 83098->83126 83127 50d08af 2 API calls 83098->83127 83128 50d0929 2 API calls 83098->83128 83129 50d0bab BaseDllReadWriteIniFile 83098->83129 83130 50d08e7 2 API calls 83098->83130 83131 50d0723 4 API calls 83098->83131 83132 50d0bbe BaseDllReadWriteIniFile 83098->83132 83133 50d06ba 4 API calls 83098->83133 83134 50d06fa 4 API calls 83098->83134 83135 50d093a 2 API calls 83098->83135 83136 50d083a 3 API calls 83098->83136 83137 50d0a7a 2 API calls 83098->83137 83138 50d0734 4 API calls 83098->83138 83139 50d08f4 2 API calls 83098->83139 83140 50d0976 2 API calls 83098->83140 83141 50d07b1 4 API calls 83098->83141 83142 50d06f0 4 API calls 83098->83142 83143 50d0bf0 BaseDllReadWriteIniFile 83098->83143 83144 50d09f3 2 API calls 83098->83144 83145 50d0b32 2 API calls 83098->83145 83857 6addc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83098->83857 83099->83098 83100->83098 83101->83098 83102->83098 83103->83098 83104->83098 83105->83098 83106->83098 83107->83098 83108->83098 83109->83098 83110->83098 83111->83098 83112->83098 83113->83098 83114->83098 83115->83098 83116->83098 83117->83098 83118->83098 83119->83098 83120->83098 83121->83098 83122->83098 83123->83098 83124->83098 83125->83098 83126->83098 83127->83098 83128->83098 83129->83098 83130->83098 83131->83098 83132->83098 83133->83098 83134->83098 83135->83098 83136->83098 83137->83098 83138->83098 83139->83098 83140->83098 83141->83098 83142->83098 83143->83098 83144->83098 83145->83098 83146->83098 83147->83098 83148->83098 83149->83098 83150->83098 83151->83098 83152->83098 83153->83098 83154->83098 83155->83098 83156->83098 83157->83098 83158->83098 83160 648c56 83159->83160 83161 677750 4 API calls 83160->83161 83162 648c7b 83161->83162 83163 673b90 4 API calls 83162->83163 83164 648ca3 83163->83164 83165 679e00 4 API calls 83164->83165 83166 648cdd __fread_nolock 83165->83166 83166->83166 83167 64a61a 83166->83167 83168 67d790 4 API calls 83166->83168 83169 612040 4 API calls 83167->83169 83172 648d95 83168->83172 83170 64a61f 83169->83170 83171 612040 4 API calls 83170->83171 83185 64a546 83171->83185 83172->83170 83172->83172 83175 67d790 4 API calls 83172->83175 83173 6f2220 3 API calls 83174 64a629 83173->83174 83176 612700 4 API calls 83174->83176 83177 648e28 83175->83177 83178 64a640 83176->83178 83259 5120e12 GetPrivateProfileStringA 83177->83259 83260 5120b32 2 API calls 83177->83260 83261 5120db0 GetPrivateProfileStringA 83177->83261 83262 5120df0 GetPrivateProfileStringA 83177->83262 83263 5120d9a GetPrivateProfileStringA 83177->83263 83264 5120d5b GetPrivateProfileStringA 83177->83264 83265 5120dd9 GetPrivateProfileStringA 83177->83265 83266 5120d5e GetPrivateProfileStringA 83177->83266 83267 5120d1f 2 API calls 83177->83267 83268 5120d82 GetPrivateProfileStringA 83177->83268 83269 5120e03 GetPrivateProfileStringA 83177->83269 83270 5120d67 GetPrivateProfileStringA 83177->83270 83271 5120dc5 GetPrivateProfileStringA 83177->83271 83179 679bb0 4 API calls 83178->83179 83180 64a655 83179->83180 83183 6fa55e 4 API calls 83211 648e5a __fread_nolock 83183->83211 83184 64a5f7 83184->82785 83185->83173 83185->83184 83186 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83186->83211 83187 675a60 4 API calls 83187->83211 83188 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83188->83211 83189 61c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83189->83211 83190 6f2dd0 3 API calls 83190->83211 83191 6f6658 7 API calls 83191->83211 83192 677f40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 83192->83211 83193 675930 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83193->83211 83194 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83194->83211 83195 673b90 4 API calls 83195->83211 83196 6ecd02 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 83196->83211 83197 677920 4 API calls 83197->83211 83198 6244f0 14 API calls 83198->83211 83199 6d2690 3 API calls 83199->83211 83200 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83200->83211 83201 624920 10 API calls 83201->83211 83202 6aefc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83202->83211 83204 6adfd0 3 API calls 83204->83211 83205 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83205->83211 83206 69d970 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83206->83211 83207 6abe90 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83207->83211 83208 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83208->83211 83209 6fa8a6 4 API calls 83209->83211 83210 673450 4 API calls 83210->83211 83211->83167 83211->83174 83211->83183 83211->83185 83211->83186 83211->83187 83211->83188 83211->83189 83211->83190 83211->83191 83211->83192 83211->83193 83211->83194 83211->83195 83211->83196 83211->83197 83211->83198 83211->83199 83211->83200 83211->83201 83211->83202 83211->83204 83211->83205 83211->83206 83211->83207 83211->83208 83211->83209 83211->83210 83212 50d068d 4 API calls 83211->83212 83213 50d084d 3 API calls 83211->83213 83214 50d078c 4 API calls 83211->83214 83215 50d0a4f 2 API calls 83211->83215 83216 50d090e 2 API calls 83211->83216 83217 50d074b 4 API calls 83211->83217 83218 50d0b0a 2 API calls 83211->83218 83219 50d07c7 4 API calls 83211->83219 83220 50d09c1 2 API calls 83211->83220 83221 50d0ac1 2 API calls 83211->83221 83222 50d0780 4 API calls 83211->83222 83223 50d0900 2 API calls 83211->83223 83224 50d0882 2 API calls 83211->83224 83225 50d0b42 2 API calls 83211->83225 83226 50d09df 2 API calls 83211->83226 83227 50d06da 4 API calls 83211->83227 83228 50d099a 2 API calls 83211->83228 83229 50d0955 2 API calls 83211->83229 83230 50d0a95 2 API calls 83211->83230 83231 50d0b96 BaseDllReadWriteIniFile 83211->83231 83232 50d08d1 2 API calls 83211->83232 83233 50d0712 4 API calls 83211->83233 83234 50d0a12 2 API calls 83211->83234 83235 50d09ad 2 API calls 83211->83235 83236 50d082d 3 API calls 83211->83236 83237 50d0aad 2 API calls 83211->83237 83238 50d076c 4 API calls 83211->83238 83239 50d0b6c BaseDllReadWriteIniFile 83211->83239 83240 50d08af 2 API calls 83211->83240 83241 50d0929 2 API calls 83211->83241 83242 50d0bab BaseDllReadWriteIniFile 83211->83242 83243 50d08e7 2 API calls 83211->83243 83244 50d0723 4 API calls 83211->83244 83245 50d0bbe BaseDllReadWriteIniFile 83211->83245 83246 50d06ba 4 API calls 83211->83246 83247 50d06fa 4 API calls 83211->83247 83248 50d093a 2 API calls 83211->83248 83249 50d083a 3 API calls 83211->83249 83250 50d0a7a 2 API calls 83211->83250 83251 50d0734 4 API calls 83211->83251 83252 50d08f4 2 API calls 83211->83252 83253 50d0976 2 API calls 83211->83253 83254 50d07b1 4 API calls 83211->83254 83255 50d06f0 4 API calls 83211->83255 83256 50d0bf0 BaseDllReadWriteIniFile 83211->83256 83257 50d09f3 2 API calls 83211->83257 83258 50d0b32 2 API calls 83211->83258 83859 6addc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83211->83859 83212->83211 83213->83211 83214->83211 83215->83211 83216->83211 83217->83211 83218->83211 83219->83211 83220->83211 83221->83211 83222->83211 83223->83211 83224->83211 83225->83211 83226->83211 83227->83211 83228->83211 83229->83211 83230->83211 83231->83211 83232->83211 83233->83211 83234->83211 83235->83211 83236->83211 83237->83211 83238->83211 83239->83211 83240->83211 83241->83211 83242->83211 83243->83211 83244->83211 83245->83211 83246->83211 83247->83211 83248->83211 83249->83211 83250->83211 83251->83211 83252->83211 83253->83211 83254->83211 83255->83211 83256->83211 83257->83211 83258->83211 83259->83211 83260->83211 83261->83211 83262->83211 83263->83211 83264->83211 83265->83211 83266->83211 83267->83211 83268->83211 83269->83211 83270->83211 83271->83211 83273 64a6c6 83272->83273 83274 677750 4 API calls 83273->83274 83275 64a6eb 83274->83275 83276 673b90 4 API calls 83275->83276 83277 64a713 83276->83277 83278 679e00 4 API calls 83277->83278 83279 64a74c __fread_nolock 83278->83279 83279->83279 83280 64b91f 83279->83280 83282 67d790 4 API calls 83279->83282 83281 612040 4 API calls 83280->83281 83283 64b924 83281->83283 83285 64a804 83282->83285 83284 612040 4 API calls 83283->83284 83299 64b84b 83284->83299 83285->83283 83285->83285 83288 67d790 4 API calls 83285->83288 83286 6f2220 3 API calls 83287 64b92e 83286->83287 83289 612700 4 API calls 83287->83289 83290 64a88f 83288->83290 83291 64b945 83289->83291 83328 5120e12 GetPrivateProfileStringA 83290->83328 83329 5120b32 2 API calls 83290->83329 83330 5120db0 GetPrivateProfileStringA 83290->83330 83331 5120df0 GetPrivateProfileStringA 83290->83331 83332 5120d9a GetPrivateProfileStringA 83290->83332 83333 5120d5b GetPrivateProfileStringA 83290->83333 83334 5120dd9 GetPrivateProfileStringA 83290->83334 83335 5120d5e GetPrivateProfileStringA 83290->83335 83336 5120d1f 2 API calls 83290->83336 83337 5120d82 GetPrivateProfileStringA 83290->83337 83338 5120e03 GetPrivateProfileStringA 83290->83338 83339 5120d67 GetPrivateProfileStringA 83290->83339 83340 5120dc5 GetPrivateProfileStringA 83290->83340 83292 679bb0 4 API calls 83291->83292 83293 64b95a 83292->83293 83295 6fa55e 4 API calls 83325 64a8c1 __fread_nolock __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 83295->83325 83298 64b8fc 83298->82785 83299->83286 83299->83298 83300 675a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83300->83325 83302 67d790 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83302->83325 83303 612830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83303->83325 83304 675d50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83304->83325 83305 6f2dd0 3 API calls 83305->83325 83306 61c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83306->83325 83307 6f6658 7 API calls 83307->83325 83308 677f40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 83308->83325 83309 675930 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83309->83325 83310 677750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83310->83325 83311 673b90 4 API calls 83311->83325 83312 6ecd02 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 83312->83325 83313 677920 4 API calls 83313->83325 83314 6244f0 14 API calls 83314->83325 83315 6d2690 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83315->83325 83316 624920 10 API calls 83316->83325 83318 6adfd0 3 API calls 83318->83325 83319 69d970 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83319->83325 83320 679bb0 4 API calls 83320->83325 83321 6aefc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83321->83325 83322 6abe90 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83322->83325 83323 679e00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83323->83325 83324 6fa8a6 4 API calls 83324->83325 83325->83280 83325->83287 83325->83295 83325->83299 83325->83300 83325->83302 83325->83303 83325->83304 83325->83305 83325->83306 83325->83307 83325->83308 83325->83309 83325->83310 83325->83311 83325->83312 83325->83313 83325->83314 83325->83315 83325->83316 83325->83318 83325->83319 83325->83320 83325->83321 83325->83322 83325->83323 83325->83324 83326 673450 4 API calls 83325->83326 83327 673170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83325->83327 83341 50d068d 4 API calls 83325->83341 83342 50d084d 3 API calls 83325->83342 83343 50d078c 4 API calls 83325->83343 83344 50d0a4f 2 API calls 83325->83344 83345 50d090e 2 API calls 83325->83345 83346 50d074b 4 API calls 83325->83346 83347 50d0b0a 2 API calls 83325->83347 83348 50d07c7 4 API calls 83325->83348 83349 50d09c1 2 API calls 83325->83349 83350 50d0ac1 2 API calls 83325->83350 83351 50d0780 4 API calls 83325->83351 83352 50d0900 2 API calls 83325->83352 83353 50d0882 2 API calls 83325->83353 83354 50d0b42 2 API calls 83325->83354 83355 50d09df 2 API calls 83325->83355 83356 50d06da 4 API calls 83325->83356 83357 50d099a 2 API calls 83325->83357 83358 50d0955 2 API calls 83325->83358 83359 50d0a95 2 API calls 83325->83359 83360 50d0b96 BaseDllReadWriteIniFile 83325->83360 83361 50d08d1 2 API calls 83325->83361 83362 50d0712 4 API calls 83325->83362 83363 50d0a12 2 API calls 83325->83363 83364 50d09ad 2 API calls 83325->83364 83365 50d082d 3 API calls 83325->83365 83366 50d0aad 2 API calls 83325->83366 83367 50d076c 4 API calls 83325->83367 83368 50d0b6c BaseDllReadWriteIniFile 83325->83368 83369 50d08af 2 API calls 83325->83369 83370 50d0929 2 API calls 83325->83370 83371 50d0bab BaseDllReadWriteIniFile 83325->83371 83372 50d08e7 2 API calls 83325->83372 83373 50d0723 4 API calls 83325->83373 83374 50d0bbe BaseDllReadWriteIniFile 83325->83374 83375 50d06ba 4 API calls 83325->83375 83376 50d06fa 4 API calls 83325->83376 83377 50d093a 2 API calls 83325->83377 83378 50d083a 3 API calls 83325->83378 83379 50d0a7a 2 API calls 83325->83379 83380 50d0734 4 API calls 83325->83380 83381 50d08f4 2 API calls 83325->83381 83382 50d0976 2 API calls 83325->83382 83383 50d07b1 4 API calls 83325->83383 83384 50d06f0 4 API calls 83325->83384 83385 50d0bf0 BaseDllReadWriteIniFile 83325->83385 83386 50d09f3 2 API calls 83325->83386 83387 50d0b32 2 API calls 83325->83387 83860 6addc0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 83325->83860 83326->83325 83327->83325 83328->83325 83329->83325 83330->83325 83331->83325 83332->83325 83333->83325 83334->83325 83335->83325 83336->83325 83337->83325 83338->83325 83339->83325 83340->83325 83341->83325 83342->83325 83343->83325 83344->83325 83345->83325 83346->83325 83347->83325 83348->83325 83349->83325 83350->83325 83351->83325 83352->83325 83353->83325 83354->83325 83355->83325 83356->83325 83357->83325 83358->83325 83359->83325 83360->83325 83361->83325 83362->83325 83363->83325 83364->83325 83365->83325 83366->83325 83367->83325 83368->83325 83369->83325 83370->83325 83371->83325 83372->83325 83373->83325 83374->83325 83375->83325 83376->83325 83377->83325 83378->83325 83379->83325 83380->83325 83381->83325 83382->83325 83383->83325 83384->83325 83385->83325 83386->83325 83387->83325 83389 5120b42 83388->83389 83390 5120d5e GetPrivateProfileStringA 83389->83390 83391 5120d52 GetPrivateProfileStringA 83390->83391 83393 5120e32 83391->83393 83393->82857 83395 5120e32 83394->83395 83395->82857 83397 5120dba GetPrivateProfileStringA 83396->83397 83399 5120e32 83397->83399 83399->82857 83401 5120df2 GetPrivateProfileStringA 83400->83401 83403 5120e32 83401->83403 83403->82857 83405 5120d5f GetPrivateProfileStringA 83404->83405 83407 5120e32 83405->83407 83407->82857 83409 5120d63 GetPrivateProfileStringA 83408->83409 83411 5120e32 83409->83411 83411->82857 83413 5120d73 GetPrivateProfileStringA 83412->83413 83415 5120e32 83413->83415 83415->82857 83417 5120df2 GetPrivateProfileStringA 83416->83417 83419 5120e32 83417->83419 83419->82857 83421 5120d89 GetPrivateProfileStringA 83420->83421 83423 5120e32 83421->83423 83423->82857 83425 5120d3c 83424->83425 83427 5120d52 GetPrivateProfileStringA 83424->83427 83426 5120d5e GetPrivateProfileStringA 83425->83426 83425->83427 83426->83427 83429 5120e32 83427->83429 83429->82857 83431 5120d89 GetPrivateProfileStringA 83430->83431 83433 5120e32 83431->83433 83433->82857 83435 5120e15 GetPrivateProfileStringA 83434->83435 83436 5120e32 83435->83436 83436->82857 83438 5120de1 GetPrivateProfileStringA 83437->83438 83440 5120e32 83438->83440 83440->82857 83442 6fa56d 83441->83442 83443 6fa5b5 83441->83443 83445 6fa573 83442->83445 83446 6fa590 83442->83446 83826 6fa5cb 4 API calls 3 library calls 83443->83826 83822 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 83445->83822 83454 6fa5ae 83446->83454 83824 6facaf RtlAllocateHeap RtlFreeHeap __dosmaperr 83446->83824 83447 6fa583 83447->82857 83454->82857 83456 50d074f 83455->83456 83457 50d07dc 83456->83457 83461 50d0831 83456->83461 83458 50d082d 3 API calls 83457->83458 83459 50d0882 2 API calls 83459->83461 83461->83459 83462 50d087f 83461->83462 83468 50d08f6 83467->83468 83469 50d0b6c BaseDllReadWriteIniFile 83468->83469 83471 50d0b59 83469->83471 83475 50d083d 83473->83475 83474 50d0882 2 API calls 83474->83475 83475->83474 83476 50d087f 83475->83476 83477 50d0b6c BaseDllReadWriteIniFile 83476->83477 83483 50d083d 83481->83483 83482 50d0882 2 API calls 83482->83483 83483->83482 83484 50d087f 83483->83484 83485 50d0b6c BaseDllReadWriteIniFile 83484->83485 83490 50d06e7 83489->83490 83491 50d07dc 83490->83491 83495 50d0831 83490->83495 83492 50d082d 3 API calls 83491->83492 83493 50d0882 2 API calls 83493->83495 83495->83493 83496 50d087f 83495->83496 83503 50d0b74 83501->83503 83502 50d0bdb 83503->83502 83504 50d0bb1 BaseDllReadWriteIniFile 83503->83504 83504->83503 83506 50d095d 83505->83506 83507 50d0b6c BaseDllReadWriteIniFile 83506->83507 83509 50d0b59 83507->83509 83512 50d071d 83511->83512 83513 50d07dc 83512->83513 83517 50d0831 83512->83517 83514 50d082d 3 API calls 83513->83514 83515 50d0882 2 API calls 83515->83517 83517->83515 83518 50d087f 83517->83518 83524 50d0931 83523->83524 83525 50d0b6c BaseDllReadWriteIniFile 83524->83525 83527 50d0b59 83525->83527 83530 50d06c3 83529->83530 83531 50d07dc 83530->83531 83535 50d0831 83530->83535 83532 50d082d 3 API calls 83531->83532 83533 50d0882 2 API calls 83533->83535 83535->83533 83536 50d087f 83535->83536 83542 50d0931 83541->83542 83543 50d0b6c BaseDllReadWriteIniFile 83542->83543 83545 50d0b59 83543->83545 83548 50d0916 83547->83548 83549 50d0b6c BaseDllReadWriteIniFile 83548->83549 83551 50d0b59 83549->83551 83555 50d0b74 83553->83555 83554 50d0bb1 BaseDllReadWriteIniFile 83554->83555 83555->83554 83556 50d0bdb 83555->83556 83558 50d0a82 83557->83558 83559 50d0b6c BaseDllReadWriteIniFile 83558->83559 83561 50d0b59 83559->83561 83564 50d0a8c 83563->83564 83565 50d0b6c BaseDllReadWriteIniFile 83564->83565 83567 50d0b59 83565->83567 83570 50d0775 83569->83570 83571 50d07dc 83570->83571 83575 50d0831 83570->83575 83572 50d082d 3 API calls 83571->83572 83573 50d0882 2 API calls 83573->83575 83575->83573 83576 50d087f 83575->83576 83582 50d096e 83581->83582 83583 50d0b6c BaseDllReadWriteIniFile 83582->83583 83586 50d0b59 83583->83586 83589 50d0831 83587->83589 83588 50d0882 2 API calls 83588->83589 83589->83588 83590 50d087f 83589->83590 83591 50d0b6c BaseDllReadWriteIniFile 83590->83591 83596 50d071d 83595->83596 83597 50d07dc 83596->83597 83601 50d0831 83596->83601 83598 50d082d 3 API calls 83597->83598 83599 50d0882 2 API calls 83599->83601 83601->83599 83602 50d087f 83601->83602 83608 50d07d4 83607->83608 83609 50d07dc 83608->83609 83613 50d0831 83608->83613 83610 50d082d 3 API calls 83609->83610 83611 50d0882 2 API calls 83611->83613 83613->83611 83614 50d087f 83613->83614 83621 50d0b74 83619->83621 83620 50d0bb1 BaseDllReadWriteIniFile 83620->83621 83621->83620 83622 50d0bdb 83621->83622 83624 50d0979 83623->83624 83625 50d0b6c BaseDllReadWriteIniFile 83624->83625 83627 50d0b59 83625->83627 83630 50d0b59 83629->83630 83631 50d0bb1 BaseDllReadWriteIniFile 83630->83631 83632 50d0bdb 83630->83632 83631->83630 83634 50d077c 83633->83634 83635 50d07dc 83634->83635 83639 50d0831 83634->83639 83636 50d082d 3 API calls 83635->83636 83637 50d0882 2 API calls 83637->83639 83639->83637 83640 50d087f 83639->83640 83646 50d06f4 83645->83646 83647 50d07dc 83646->83647 83651 50d0831 83646->83651 83648 50d082d 3 API calls 83647->83648 83649 50d0882 2 API calls 83649->83651 83651->83649 83652 50d087f 83651->83652 83658 50d0b54 83657->83658 83659 50d0b6c BaseDllReadWriteIniFile 83658->83659 83661 50d0b59 83659->83661 83664 50d0b09 83663->83664 83664->83663 83665 50d0b6c BaseDllReadWriteIniFile 83664->83665 83667 50d0b59 83665->83667 83670 50d0786 83669->83670 83671 50d07dc 83670->83671 83675 50d0831 83670->83675 83672 50d082d 3 API calls 83671->83672 83673 50d0882 2 API calls 83673->83675 83675->83673 83676 50d087f 83675->83676 83682 50d0aca 83681->83682 83683 50d0b6c BaseDllReadWriteIniFile 83682->83683 83685 50d0b59 83683->83685 83688 50d0899 83687->83688 83689 50d0b6c BaseDllReadWriteIniFile 83688->83689 83691 50d0b59 83689->83691 83694 50d0906 83693->83694 83695 50d0b6c BaseDllReadWriteIniFile 83694->83695 83697 50d0b59 83695->83697 83700 50d09e5 83699->83700 83701 50d0b6c BaseDllReadWriteIniFile 83700->83701 83702 50d0b59 83701->83702 83706 50d0b59 83705->83706 83707 50d0b4e 83705->83707 83709 50d0bb1 BaseDllReadWriteIniFile 83706->83709 83710 50d0bdb 83706->83710 83708 50d0b6c BaseDllReadWriteIniFile 83707->83708 83708->83706 83709->83706 83712 50d09b5 83711->83712 83713 50d0b6c BaseDllReadWriteIniFile 83712->83713 83715 50d0b59 83713->83715 83718 50d09db 83717->83718 83719 50d0b6c BaseDllReadWriteIniFile 83718->83719 83721 50d0b59 83719->83721 83724 50d0aa5 83723->83724 83725 50d0b6c BaseDllReadWriteIniFile 83724->83725 83726 50d0b59 83725->83726 83730 50d095b 83729->83730 83731 50d0b6c BaseDllReadWriteIniFile 83730->83731 83732 50d0b59 83731->83732 83736 50d08f6 83735->83736 83737 50d0b6c BaseDllReadWriteIniFile 83736->83737 83739 50d0b59 83737->83739 83742 50d07dc 83741->83742 83746 50d0831 83741->83746 83743 50d082d 3 API calls 83742->83743 83745 50d081b 83743->83745 83744 50d0882 2 API calls 83744->83746 83746->83744 83747 50d087f 83746->83747 83748 50d0b6c BaseDllReadWriteIniFile 83747->83748 83753 50d0a19 83752->83753 83754 50d0b6c BaseDllReadWriteIniFile 83753->83754 83756 50d0b59 83754->83756 83759 50d06d7 83758->83759 83760 50d07dc 83759->83760 83764 50d0831 83759->83764 83761 50d082d 3 API calls 83760->83761 83762 50d0882 2 API calls 83762->83764 83764->83762 83765 50d087f 83764->83765 83771 50d0bb1 BaseDllReadWriteIniFile 83770->83771 83773 50d0b74 83771->83773 83772 50d0bdb 83773->83771 83773->83772 83775 50d08c6 83774->83775 83776 50d0b6c BaseDllReadWriteIniFile 83775->83776 83778 50d0b59 83776->83778 83781 50d09e5 83780->83781 83782 50d0b6c BaseDllReadWriteIniFile 83781->83782 83784 50d0b59 83782->83784 83787 50d0786 83786->83787 83788 50d07dc 83787->83788 83792 50d0831 83787->83792 83789 50d082d 3 API calls 83788->83789 83790 50d0882 2 API calls 83790->83792 83792->83790 83793 50d087f 83792->83793 83799 50d0a4d 83798->83799 83800 50d0b6c BaseDllReadWriteIniFile 83799->83800 83802 50d0b59 83800->83802 83805 50d06f4 83804->83805 83806 50d07dc 83805->83806 83810 50d0831 83805->83810 83807 50d082d 3 API calls 83806->83807 83808 50d0882 2 API calls 83808->83810 83810->83808 83811 50d087f 83810->83811 83817 6d2690 3 API calls 83816->83817 83818 6d27e3 83817->83818 83818->82857 83819->82857 83820->82857 83826->83447 83830 677950 83827->83830 83828 67798e 83832 6ecd02 std::_Facet_Register 4 API calls 83828->83832 83829 677a09 83856 617d60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 83829->83856 83830->83828 83830->83829 83838 6779d4 83830->83838 83834 6779a8 83832->83834 83833 677a0e 83838->82953 83840 6734a8 83839->83840 83841 673475 83839->83841 83842 6734ca 83840->83842 83843 6734e8 83840->83843 83844 6ecd02 std::_Facet_Register 4 API calls 83841->83844 83845 677920 4 API calls 83842->83845 83849 612700 4 API calls 83843->83849 83846 67347f 83844->83846 83848 6734d5 83845->83848 83847 6ecd02 std::_Facet_Register 4 API calls 83846->83847 83847->83840 83848->82953 83850 6734f8 83849->83850 83855->82953 83856->83833 83857->83098 83859->83211 83860->83325 83861 67c410 83862 67c43d 83861->83862 83863 67c417 83861->83863 83863->83862 83864 6f2220 3 API calls 83863->83864 83865 677f40 83864->83865 83866 67b0c0 4 API calls 83865->83866 83868 677f8c 83865->83868 83867 677f53 83866->83867 83867->83868 83869 6f2220 3 API calls 83867->83869 83870 677fb4 83869->83870 83881 613b70 4 API calls 2 library calls 83870->83881 83872 678061 83873 6ecd02 std::_Facet_Register 4 API calls 83872->83873 83874 678068 83873->83874 83875 6ebb0e std::locale::_Init 4 API calls 83874->83875 83876 67807b 83875->83876 83882 679520 5 API calls 4 library calls 83876->83882 83878 6780ae 83879 6780f2 83878->83879 83883 613b70 4 API calls 2 library calls 83878->83883 83881->83872 83882->83878 83883->83879 83884 51809a2 83885 51809a8 GetCurrentHwProfileW 83884->83885 83886 518096b 83884->83886 83887 51809d1 83885->83887 83886->83885 83888 6fcc92 83891 6fcb02 83888->83891 83892 6fcb2f std::locale::_Setgloballocale 83891->83892 83898 6fc993 83892->83898 83894 6fcb7e 83895 6fcb78 83895->83894 83902 6fcb99 83895->83902 83899 6fc99f __fread_nolock std::_Lockit::_Lockit 83898->83899 83905 6fca1a 83899->83905 83901 6fc9b6 std::locale::_Setgloballocale 83901->83895 83903 6fcba3 std::locale::_Setgloballocale 83902->83903 83904 6fcbbf ExitProcess 83903->83904 83906 6fca26 __fread_nolock std::locale::_Setgloballocale 83905->83906 83908 6fca8a std::locale::_Setgloballocale 83906->83908 83909 6ffe94 RtlAllocateHeap RtlFreeHeap __EH_prolog3 std::locale::_Init std::locale::_Setgloballocale 83906->83909 83908->83901 83909->83908

                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                  Function 00668220 Relevance: 80.3, APIs: 31, Strings: 12, Instructions: 5012COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                                                  • String ID: 0bt$@bt$@bt$@bt$@bt$@bt$@bt$@bt$Xat$Xat$``t$pbt
                                                                                                                                                                                                  • API String ID: 3883471643-809645448
                                                                                                                                                                                                  • Opcode ID: 2524537fb87c718a0cccd7739ef07b37bf9eea2672496f4cf0e20707e9ca7fff
                                                                                                                                                                                                  • Instruction ID: db1c85b87e757ea396cc9f538c6184478d01e48a478561bcf5a833531693bbc1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2524537fb87c718a0cccd7739ef07b37bf9eea2672496f4cf0e20707e9ca7fff
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8A3F2709002588FEF29CF68CC587EDBBB6AF06304F1482DCD449AB292DB759A85CF55
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006521E0 Relevance: 42.8, APIs: 22, Strings: 1, Instructions: 2535COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00652270
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 006522CC
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00652C73
                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 006522FD
                                                                                                                                                                                                    • Part of subcall function 0061BF40: GetFileAttributesA.KERNEL32 ref: 0061BF6E
                                                                                                                                                                                                    • Part of subcall function 0061BF40: __Mtx_unlock.LIBCPMT ref: 0061BF9E
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0065241E
                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0065244D
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 006525FD
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0065265B
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0065280A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateDirectory$FolderPath$AttributesFileMtx_unlock
                                                                                                                                                                                                  • String ID: t&cy
                                                                                                                                                                                                  • API String ID: 2791087084-2664440697
                                                                                                                                                                                                  • Opcode ID: c5f05f26c592fe366b3b4ef7a9530c0299a387eba0d6ea8eebc3e429d7bf2acd
                                                                                                                                                                                                  • Instruction ID: 2c740e2cc69eba609147023b41b846263fbc06427536c222e4a8fe7718cdd87b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c5f05f26c592fe366b3b4ef7a9530c0299a387eba0d6ea8eebc3e429d7bf2acd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F338F70C002699ADB61EB60CC55BDEB776AF21304F4841DCD84977282EB755BC8CFAA
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006651F0 Relevance: 36.8, APIs: 11, Strings: 8, Instructions: 3585COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066637E
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066638D
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0066738F
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 006675FC
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066760B
                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?), ref: 0066836E
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                                                  • String ID: at$ at$ bt$ bt$@bt$@bt$pbt$type must be boolean, but is
                                                                                                                                                                                                  • API String ID: 3883471643-578164919
                                                                                                                                                                                                  • Opcode ID: 86256133b50da897b309ef2c7c6ac580365d9e5ddc64e4de3bf0d33487803304
                                                                                                                                                                                                  • Instruction ID: 788f4030cb4f6ce45894c88b31c797245f0b91e840a02c84ea1b2a2ef5529474
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 86256133b50da897b309ef2c7c6ac580365d9e5ddc64e4de3bf0d33487803304
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9573EF708042588FDF29DB68CC58BEDBBB6AF15304F1481DCE04AA7292DB745B89CF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0061F000 Relevance: 30.2, APIs: 19, Instructions: 1719COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1886074773-0
                                                                                                                                                                                                  • Opcode ID: 3d428e27cda3b37857f13cb1cf8f32b003671fb4cb2aae31ea7f019b4f3f5dcd
                                                                                                                                                                                                  • Instruction ID: 93e7b66f91102eb475e328dc1c7d2bc3e11992fa51322c5182f872b0d285eebf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3d428e27cda3b37857f13cb1cf8f32b003671fb4cb2aae31ea7f019b4f3f5dcd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EFD24A71D002489FEF08DBB8DC957EDB7B7AF16300F28826CE405AB292D7759A85CB51
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0066D0C0 Relevance: 29.1, APIs: 18, Instructions: 2093COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 006521E0: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00652270
                                                                                                                                                                                                    • Part of subcall function 006521E0: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 006522CC
                                                                                                                                                                                                    • Part of subcall function 006521E0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 006522FD
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,?,AFB5888B,00743AFC,00000000,AFB5888B,AFB5888C), ref: 0066D1C2
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066D3D6
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066D3E5
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066D5F6
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066D605
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066D806
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066D815
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066DB06
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066DB15
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E00E
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E01D
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E216
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E225
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E427
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E436
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E726
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0066E735
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,?,B6B88F8B,00743AFC,00000000,B6B88F8B,B6B88F8C), ref: 0066DDFC
                                                                                                                                                                                                    • Part of subcall function 0067D790: Concurrency::cancel_current_task.LIBCPMT ref: 0067D86D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$CreateDirectory$Concurrency::cancel_current_taskFolderPath
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 791088107-0
                                                                                                                                                                                                  • Opcode ID: a498b96786a4a8b4448dd2e4243288ec09e132d78fe7f68a57374325a9414793
                                                                                                                                                                                                  • Instruction ID: 7b2eaaee85d83ed4a03abe07ece9651d662f397f59e148e6edfa86320f542f1c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a498b96786a4a8b4448dd2e4243288ec09e132d78fe7f68a57374325a9414793
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7E033971E00248CFDF18DB68CC94BEDBB76AF16304F14829CE045BB292DB759A85CB65
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00657DC0 Relevance: 25.0, APIs: 10, Strings: 1, Instructions: 5797COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?), ref: 00657E7C
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00657EB0
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000), ref: 00657FD9
                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 006580E5
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(000004E3,00000000,?,000000FF,00000000,00000000), ref: 006586F7
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(000004E3,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 0065874C
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharCreateDirectoryMultiWide$AttributesFileMtx_unlock
                                                                                                                                                                                                  • String ID: Hat
                                                                                                                                                                                                  • API String ID: 1401654926-2856774313
                                                                                                                                                                                                  • Opcode ID: 2326574a4abff7b709c648387e0f3dd26cc43815f33eaf8821e33e543b50b9e5
                                                                                                                                                                                                  • Instruction ID: a898a8eee64031b63af005481627b9ba15f45bf0d096c91a0985ff4ea5747123
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2326574a4abff7b709c648387e0f3dd26cc43815f33eaf8821e33e543b50b9e5
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 67B3FE71C00259CEDF25DF68C8557EEBBB6AF06304F1482CCD84967282DB715B8ACBA5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00620530 Relevance: 23.3, APIs: 13, Instructions: 3825COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?,?), ref: 00620734
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00620762
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0062098D
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0062099C
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00620D36
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00620D46
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00620F26
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00620F35
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00621076
                                                                                                                                                                                                    • Part of subcall function 0061BF40: GetFileAttributesA.KERNEL32 ref: 0061BF6E
                                                                                                                                                                                                    • Part of subcall function 0061BF40: __Mtx_unlock.LIBCPMT ref: 0061BF9E
                                                                                                                                                                                                    • Part of subcall function 00675D50: Concurrency::cancel_current_task.LIBCPMT ref: 00675E37
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00621085
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0062121B
                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 006213C5
                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 006213EC
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesFileFolderPath$Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1290385620-0
                                                                                                                                                                                                  • Opcode ID: 3319d122cd15760586e47f800025b0b8fd2a402a1738301e7a492c33d2ac43bf
                                                                                                                                                                                                  • Instruction ID: f015f1cfacec43ed56beca59018a86b99c4f3507b95679d2974315595ed63d0d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3319d122cd15760586e47f800025b0b8fd2a402a1738301e7a492c33d2ac43bf
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A5731470C00259CADF54EB64CC65BEEBB76AF21304F0841DCE44967292EB715B89CFA6
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0064D530 Relevance: 19.1, APIs: 7, Strings: 3, Instructions: 1648COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?,00746240), ref: 0064D6C0
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064D6F0
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064E256
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064E266
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064EBFD
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064D7DC
                                                                                                                                                                                                    • Part of subcall function 0067D790: Concurrency::cancel_current_task.LIBCPMT ref: 0067D86D
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064EBB4
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesConcurrency::cancel_current_taskFile
                                                                                                                                                                                                  • String ID: @bt$invalid stoi argument$stoi argument out of range
                                                                                                                                                                                                  • API String ID: 3826552558-4138578220
                                                                                                                                                                                                  • Opcode ID: 74ef9cc472db1d3741381f342ea26c28e0f0b8e0d579113ce37f42d947879c6c
                                                                                                                                                                                                  • Instruction ID: a743477ae46fe69a29abcd18b687074bb961838bfa7116bd780131d32b9aca20
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 74ef9cc472db1d3741381f342ea26c28e0f0b8e0d579113ce37f42d947879c6c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E6E2D171D002588FEF18CB68CC98BEDBB76AF55304F1482DCD049AB292DB755AC9CB61
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00659040 Relevance: 14.5, APIs: 4, Strings: 2, Instructions: 3969COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AttributesFileMtx_unlock
                                                                                                                                                                                                  • String ID: Hat$type must be boolean, but is
                                                                                                                                                                                                  • API String ID: 1424188087-1179091924
                                                                                                                                                                                                  • Opcode ID: c5e1956aa0490dba14e8b5cf40b5945087ef3b5e79373f7d51627f80267fc18f
                                                                                                                                                                                                  • Instruction ID: 53e397e0758eb7f514ec010aa68167d1f11b528454a2b611d39f6d4a8e21e8bf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c5e1956aa0490dba14e8b5cf40b5945087ef3b5e79373f7d51627f80267fc18f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5383CD71C00269CADF25DF68C9157EEBBB6AF16304F5482CCD84927282DB711B8ACF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0061C000 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 262COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 16652 61c000-61c038 call 6ec284 16655 61c3c2-61c3c3 call 6ebf2b 16652->16655 16656 61c03e-61c077 16652->16656 16657 61c3c8 call 612040 16655->16657 16656->16657 16658 61c07d-61c106 call 67d790 FindFirstFileA 16656->16658 16663 61c3cd-61c3d2 call 6f2220 16657->16663 16668 61c319 16658->16668 16669 61c10c 16658->16669 16670 61c31b-61c321 16668->16670 16671 61c110-61c119 16669->16671 16672 61c323-61c32f 16670->16672 16673 61c34f-61c367 16670->16673 16674 61c120-61c125 16671->16674 16677 61c331-61c33f 16672->16677 16678 61c345-61c34c call 6ecf83 16672->16678 16675 61c391-61c3c1 call 6ec295 16673->16675 16676 61c369-61c375 16673->16676 16674->16674 16679 61c127-61c173 16674->16679 16681 61c387-61c38e call 6ecf83 16676->16681 16682 61c377-61c385 16676->16682 16677->16663 16677->16678 16678->16673 16679->16657 16689 61c179-61c24c call 67d790 call 675a60 call 675bd0 16679->16689 16681->16675 16682->16663 16682->16681 16700 61c26c-61c285 16689->16700 16701 61c24e-61c255 call 61c000 16689->16701 16704 61c28b-61c29f 16700->16704 16705 61c30f-61c317 16700->16705 16701->16700 16704->16705 16708 61c2a1-61c2b2 FindNextFileA 16704->16708 16705->16670 16708->16671 16709 61c2b8-61c2ca 16708->16709 16709->16670 16712 61c2cc-61c2d2 16709->16712 16713 61c2d4 16712->16713 16714 61c2d6-61c2e4 SetFileAttributesA 16712->16714 16713->16714 16715 61c2f1-61c2f5 16714->16715 16716 61c2e6-61c2ef 16714->16716 16717 61c2f7 16715->16717 16718 61c2f9-61c302 RemoveDirectoryA 16715->16718 16716->16670 16717->16718 16718->16668 16719 61c304-61c30d 16718->16719 16719->16670
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: @bt$\*.*
                                                                                                                                                                                                  • API String ID: 0-2430154125
                                                                                                                                                                                                  • Opcode ID: dacc51ffa87457a01b43cfb6dab8e2090cc0e84eb57f88340bf09140838f3e39
                                                                                                                                                                                                  • Instruction ID: 7c6ce00dde050461030b5cebd8eb995a2437aa1565a847c6106eb773da7b94b4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dacc51ffa87457a01b43cfb6dab8e2090cc0e84eb57f88340bf09140838f3e39
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1A910571D40248DFDB18DBA8C958BEDB7B6AF19314F248698E411B7282DB719EC0CB61
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00644880 Relevance: 10.5, APIs: 2, Strings: 3, Instructions: 1745COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00645926
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0064593B
                                                                                                                                                                                                    • Part of subcall function 0061BF40: GetFileAttributesA.KERNEL32 ref: 0061BF6E
                                                                                                                                                                                                    • Part of subcall function 0061BF40: __Mtx_unlock.LIBCPMT ref: 0061BF9E
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesFile
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with $wszw$zwcE
                                                                                                                                                                                                  • API String ID: 1886074773-995642859
                                                                                                                                                                                                  • Opcode ID: 1e27f712b33c36d8668c80995f8f4f8ba262f604780c80719c532cc8d82f0ce6
                                                                                                                                                                                                  • Instruction ID: a62f8a26c0a877625cfbf510ad0eca28fa85c0fdc3e42035f5fdd0b8f79bac94
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e27f712b33c36d8668c80995f8f4f8ba262f604780c80719c532cc8d82f0ce6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 70F2D270C002688BDB65EB64CC557EDBBB6AF15304F1481DCE44967282EB705BC9CFA6
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0065DB00 Relevance: 10.0, Strings: 7, Instructions: 1269COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 17467 65db00-65db3b 17468 65db42-65db67 17467->17468 17469 65ee26-65ee33 call 6502f0 17468->17469 17470 65db6d-65dbac 17468->17470 17474 65ee38-65ee4e 17469->17474 17471 65dbb0-65dbbe 17470->17471 17471->17471 17473 65dbc0-65dbec 17471->17473 17475 65dbf0-65dbf5 17473->17475 17476 65ee50-65ee5b 17474->17476 17475->17475 17477 65dbf7-65dc2c call 612830 17475->17477 17476->17476 17478 65ee5d-65ee8c call 679e00 call 673850 17476->17478 17483 65dc30-65dc3e 17477->17483 17488 65ee90-65ee9b 17478->17488 17483->17483 17485 65dc40-65dc6f 17483->17485 17487 65dc70-65dc75 17485->17487 17487->17487 17489 65dc77-65dcea call 612830 call 675d50 * 2 call 630b30 17487->17489 17488->17488 17490 65ee9d-65ef13 call 679e00 call 6737f0 * 2 17488->17490 17505 65dcf0-65dcfb 17489->17505 17505->17505 17506 65dcfd-65ddb6 call 679e00 call 673850 call 673450 call 6737f0 * 2 17505->17506 17517 65ddc0-65ddce 17506->17517 17517->17517 17518 65ddd0-65ddfc 17517->17518 17519 65de00-65de05 17518->17519 17519->17519 17520 65de07-65de36 call 612830 17519->17520 17523 65de40-65de4e 17520->17523 17523->17523 17524 65de50-65de7c 17523->17524 17525 65de80-65de85 17524->17525 17525->17525 17526 65de87-65defa call 612830 call 675d50 * 2 call 630b30 17525->17526 17535 65df00-65df0b 17526->17535 17535->17535 17536 65df0d-65dfb8 call 679e00 call 673850 call 673450 call 6737f0 * 2 17535->17536 17547 65dfc0-65dfce 17536->17547 17547->17547 17548 65dfd0-65dff9 17547->17548 17549 65e000-65e005 17548->17549 17549->17549 17550 65e007-65e06d call 612830 call 675d50 call 633370 17549->17550 17557 65e070-65e07e 17550->17557 17557->17557 17558 65e080-65e12c call 679e00 call 673850 call 673450 call 6737f0 * 2 17557->17558 17569 65e130-65e13b 17558->17569 17569->17569 17570 65e13d-65e15c 17569->17570 17571 65e163-65e168 17570->17571 17571->17571 17572 65e16a-65e1c7 call 612830 call 675d50 call 6346d0 17571->17572 17579 65e1d0-65e1de 17572->17579 17579->17579 17580 65e1e0-65e29f call 679e00 call 673850 call 673450 call 6737f0 * 2 17579->17580 17591 65e2a0-65e2ae 17580->17591 17591->17591 17592 65e2b0-65e2dc 17591->17592 17593 65e2e0-65e2e5 17592->17593 17593->17593 17594 65e2e7-65e31b call 612830 17593->17594 17597 65e320-65e32e 17594->17597 17597->17597 17598 65e330-65e35c 17597->17598 17599 65e360-65e365 17598->17599 17599->17599 17600 65e367-65e3bd call 612830 call 675d50 call 635a30 17599->17600 17607 65e3c1-65e3cc 17600->17607 17607->17607 17608 65e3ce-65e487 call 679e00 call 673850 call 673450 call 6737f0 * 2 17607->17608 17619 65e490-65e49e 17608->17619 17619->17619 17620 65e4a0-65e4cc 17619->17620 17621 65e4d0-65e4d5 17620->17621 17621->17621 17622 65e4d7-65e4fc call 612830 17621->17622 17625 65e500-65e50b 17622->17625 17625->17625 17626 65e50d-65e52c 17625->17626 17627 65e533-65e538 17626->17627 17627->17627 17628 65e53a-65e59d call 612830 call 675d50 call 638510 17627->17628 17635 65e5a0-65e5ae 17628->17635 17635->17635 17636 65e5b0-65e66f call 679e00 call 673850 call 673450 call 6737f0 * 2 17635->17636 17647 65e670-65e67e 17636->17647 17647->17647 17648 65e680-65e6ac 17647->17648 17649 65e6b0-65e6b5 17648->17649 17649->17649 17650 65e6b7-65e6dc call 612830 17649->17650 17653 65e6e0-65e6eb 17650->17653 17653->17653 17654 65e6ed-65e70c 17653->17654 17655 65e713-65e718 17654->17655 17655->17655 17656 65e71a-65e77d call 612830 call 675d50 call 638510 17655->17656 17663 65e780-65e78e 17656->17663 17663->17663 17664 65e790-65e83c call 679e00 call 673850 call 673450 call 6737f0 * 2 17663->17664 17675 65e840-65e84b 17664->17675 17675->17675 17676 65e84d-65e86c 17675->17676 17677 65e873-65e878 17676->17677 17677->17677 17678 65e87a-65e8db call 612830 call 675d50 call 63a700 17677->17678 17685 65e8e0-65e8ee 17678->17685 17685->17685 17686 65e8f0-65e9af call 679e00 call 673850 call 673450 call 6737f0 * 2 17685->17686 17697 65e9b0-65e9be 17686->17697 17697->17697 17698 65e9c0-65e9ec 17697->17698 17699 65e9f0-65e9f5 17698->17699 17699->17699 17700 65e9f7-65ea1c call 612830 17699->17700 17703 65ea22-65ea2d 17700->17703 17703->17703 17704 65ea2f-65ea4e 17703->17704 17705 65ea55-65ea5a 17704->17705 17705->17705 17706 65ea5c-65eab2 call 612830 call 675d50 call 63ba00 17705->17706 17713 65eab6-65eac1 17706->17713 17713->17713 17714 65eac3-65eb4e call 679e00 call 673850 call 673450 call 6737f0 * 2 17713->17714 17725 65eb54-65eb7f 17714->17725 17726 65ecfc-65ed03 17714->17726 17727 65eb82-65eb90 17725->17727 17726->17468 17727->17727 17728 65eb92-65ebbe 17727->17728 17729 65ebc0-65ebc5 17728->17729 17729->17729 17730 65ebc7-65ec00 call 612830 call 675d50 call 640fb0 17729->17730 17736 65ec05-65ec0e 17730->17736 17737 65ec10-65ec31 17736->17737 17738 65ec37-65ecb3 call 675d50 * 4 17737->17738 17739 65ecf1-65ecf7 call 672580 17737->17739 17749 65ecb5-65ecd1 call 689630 call 65f030 17738->17749 17750 65ecd6-65ecec call 681160 call 65f030 17738->17750 17739->17726 17749->17737 17750->17737
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: at$ bt$0bt$P`t$Xat$``t$pbt
                                                                                                                                                                                                  • API String ID: 0-2379609455
                                                                                                                                                                                                  • Opcode ID: 9a72c72656f05c94dbb6b31deffe08f91378e3cab0436a8f0ece0beee3581e78
                                                                                                                                                                                                  • Instruction ID: 640d1f39da5a673a5c67803d3df7b8112fd83025140edc53d10940483f77e4c8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9a72c72656f05c94dbb6b31deffe08f91378e3cab0436a8f0ece0beee3581e78
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F0C2D070D042998BDB19DF64C859BEEBBB2AF1A304F1481DCD44967342EB309B89CF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006EA800 Relevance: 9.2, Strings: 7, Instructions: 490COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 17906 6ea800-6ea81e call 6e9300 17909 6ea824-6ea82d 17906->17909 17910 6eae81-6eae87 17906->17910 17911 6ea82f-6ea831 17909->17911 17912 6ea833-6ea839 17909->17912 17915 6ea853-6ea859 17911->17915 17913 6ea83f-6ea850 17912->17913 17914 6ea83b-6ea83d 17912->17914 17913->17915 17914->17915 17916 6ea85b-6ea861 17915->17916 17917 6ea863-6ea86a 17915->17917 17918 6ea872-6ea889 call 69b5d0 17916->17918 17917->17918 17919 6ea86c 17917->17919 17922 6ea88f-6ea8a1 call 6eef60 17918->17922 17923 6eae66 17918->17923 17919->17918 17928 6ea8a7-6ea8ae 17922->17928 17929 6ea945-6ea94a 17922->17929 17925 6eae68 17923->17925 17927 6eae6f-6eae77 call 6e9e40 17925->17927 17938 6eae79-6eae7f 17927->17938 17933 6ea8b9-6ea8c9 17928->17933 17934 6ea8b0-6ea8b7 17928->17934 17931 6ea94c-6ea953 17929->17931 17932 6ea956-6eaa0e call 69b150 17929->17932 17931->17932 17946 6eaa26-6eaa95 call 6ea660 * 4 17932->17946 17947 6eaa10-6eaa21 call 69d970 17932->17947 17933->17929 17937 6ea8cb-6ea8d2 17933->17937 17934->17937 17940 6ea934-6ea93b 17937->17940 17941 6ea8d4-6ea8db 17937->17941 17938->17910 17951 6ea93e-6ea940 17940->17951 17944 6ea8dd-6ea8e4 17941->17944 17945 6ea8e7-6ea921 17941->17945 17944->17945 17945->17951 17962 6ea923-6ea92f 17945->17962 17960 6eadf2-6eadf7 17946->17960 17976 6eaa9b-6eaae3 call 6c6850 call 6ea660 17946->17976 17956 6eadf0 17947->17956 17951->17925 17956->17960 17963 6eadf9-6eae00 17960->17963 17964 6eae03-6eae0b 17960->17964 17962->17925 17963->17964 17966 6eae0d-6eae12 17964->17966 17967 6eae36-6eae3c 17964->17967 17966->17967 17970 6eae14-6eae19 17966->17970 17967->17925 17971 6eae3e-6eae4a 17967->17971 17970->17967 17974 6eae1b-6eae35 17970->17974 17971->17927 17975 6eae4c-6eae4e 17971->17975 17975->17938 17977 6eae50-6eae65 17975->17977 17982 6eaaea-6eaaf0 17976->17982 17983 6eaae5-6eaae8 17976->17983 17984 6eaaf6-6eab07 call 6a66a0 17982->17984 17983->17982 17983->17984 17987 6eab0d-6eab15 17984->17987 17988 6eac95-6eacaf call 69d970 17984->17988 17989 6eac8d-6eac8f 17987->17989 17990 6eab1b-6eab2f 17987->17990 17988->17956 17989->17988 17993 6eab44-6eab94 call 6c6e00 * 2 17989->17993 17990->17989 17992 6eab35-6eab41 17990->17992 17992->17993 17993->17960 18000 6eab9a-6eabc5 call 69d970 call 6ea4e0 17993->18000 18005 6eabcb 18000->18005 18006 6eac63-6eac71 18000->18006 18009 6eabd0-6eabd4 18005->18009 18007 6eada9-6eadb1 18006->18007 18008 6eac77-6eac7c 18006->18008 18011 6eadb3-6eadb8 18007->18011 18012 6eadc1-6eadc5 18007->18012 18013 6eac80-6eac87 18008->18013 18009->18009 18010 6eabd6-6eabe7 18009->18010 18014 6eabe9-6eabf0 18010->18014 18015 6eabf3-6eac0b call 6c6aa0 18010->18015 18011->18012 18016 6eadba-6eadbf 18011->18016 18012->17956 18017 6eadc7-6eadcd 18012->18017 18018 6eac89-6eac8b 18013->18018 18019 6eacb4-6eacc3 18013->18019 18014->18015 18030 6eac0d-6eac26 call 6ea4e0 18015->18030 18031 6eac29-6eac2f 18015->18031 18016->17956 18016->18012 18017->17956 18021 6eadcf-6eade8 call 69d970 call 6e9a90 18017->18021 18022 6eaccf-6eacd5 18018->18022 18019->18022 18033 6eacc5-6eaccc 18019->18033 18045 6eaded 18021->18045 18024 6eacde-6eace3 18022->18024 18025 6eacd7-6eacdc 18022->18025 18029 6eace6-6eace8 18024->18029 18025->18029 18034 6eacea-6eacf1 18029->18034 18035 6eacf4-6eacfb 18029->18035 18030->18031 18037 6eac46-6eac4e 18031->18037 18038 6eac31-6eac41 call 69d970 18031->18038 18033->18022 18034->18035 18042 6eacfd-6ead0e 18035->18042 18043 6ead29-6ead2b 18035->18043 18046 6eac5a-6eac5d 18037->18046 18047 6eac50-6eac57 18037->18047 18038->18037 18059 6ead26 18042->18059 18060 6ead10-6ead23 call 69d970 18042->18060 18048 6ead2d-6ead34 18043->18048 18049 6ead98-6eada3 18043->18049 18045->17956 18046->18006 18050 6eac5f 18046->18050 18047->18046 18054 6ead8e 18048->18054 18055 6ead36-6ead3d 18048->18055 18049->18007 18049->18013 18050->18006 18061 6ead95 18054->18061 18057 6ead3f-6ead46 18055->18057 18058 6ead49-6ead83 18055->18058 18057->18058 18058->18049 18067 6ead85-6ead8c 18058->18067 18059->18043 18060->18059 18061->18049 18067->18061
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
                                                                                                                                                                                                  • API String ID: 0-1885142750
                                                                                                                                                                                                  • Opcode ID: 7903a601597d719e0387c8254beb384e8b4a6ec95fb78f21e5747fb5c1820bd0
                                                                                                                                                                                                  • Instruction ID: 604e01d8af833d4c6a1a69ee340cd254eeb264cda928b4151497bcbfce5dc96a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7903a601597d719e0387c8254beb384e8b4a6ec95fb78f21e5747fb5c1820bd0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 560279B4B013809BEB208F56CC45B6B77F6AF41704F14842DE40A9B392E7B9F945CB86
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00663850 Relevance: 9.0, Strings: 6, Instructions: 1493COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesConcurrency::cancel_current_taskCreateDirectoryFile
                                                                                                                                                                                                  • String ID: /$P`t$P`t$P`t$P`t$P`t
                                                                                                                                                                                                  • API String ID: 1266625421-4024813325
                                                                                                                                                                                                  • Opcode ID: a04a0e5613b51f612d35cc884853182b6f42d687f3842e896a94968170872366
                                                                                                                                                                                                  • Instruction ID: 31993f47a43c081649172205917196e4b68c2961e0692f05e855ce2e55e61ac7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a04a0e5613b51f612d35cc884853182b6f42d687f3842e896a94968170872366
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8FE26C70D102598ADF65EBA0CC66BEEB776AF15304F44409CE40973292EF741B89CFA9
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00638510 Relevance: 7.5, APIs: 1, Strings: 2, Instructions: 2231COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                  • String ID: XSP_$cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 1620887387-1421476562
                                                                                                                                                                                                  • Opcode ID: 2916025711b60d2895c10f97105ee56cf2604cd66d29fcdc02fcc25e73d6356e
                                                                                                                                                                                                  • Instruction ID: f7de0e6bb9e585e039a139d68c51f7033ec841701736d6e9049d6ca87590c933
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2916025711b60d2895c10f97105ee56cf2604cd66d29fcdc02fcc25e73d6356e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D23FD70D00259CBDB25DB64C855BEEBBB6AF15300F1481ECE44967382EB746B88CFA5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00648C20 Relevance: 6.9, Strings: 4, Instructions: 1892COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: Z8tu$aC~q$cannot use operator[] with a string argument with $pKHG
                                                                                                                                                                                                  • API String ID: 0-2261802442
                                                                                                                                                                                                  • Opcode ID: 11e7d35bb821f98c4298efe751f58150eefe8602c64a912923224b33c8aff15d
                                                                                                                                                                                                  • Instruction ID: 0fa52b993e4d38d14d2966e4f0289b884cdd86b7b32f4c3975eda9d41a0d1d5a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 11e7d35bb821f98c4298efe751f58150eefe8602c64a912923224b33c8aff15d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4C03E070D002599BDB25CF68C844BEEBBB6AF55304F1441EDD449A7382EB74AE84CFA1
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0064A690 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1484libraryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0064B55A
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(B6ACB9A1,?), ref: 0064B9D6
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • cannot use operator[] with a string argument with , xrefs: 0064B946
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LibraryLoadUnothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 2188052229-2766135566
                                                                                                                                                                                                  • Opcode ID: e0035465b0461a7f3c7da7c5b52e444b755a661d10046b24198650696a0b4772
                                                                                                                                                                                                  • Instruction ID: d76fd0ced76e22ae07f510faa46258e35e23baf5aa6f9df1d8204fa9244fa002
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e0035465b0461a7f3c7da7c5b52e444b755a661d10046b24198650696a0b4772
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0D21270D002589FDB25CF68CC44BEEBBB6AF15304F1481DDD449AB292E774AA88CF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006502F0 Relevance: 6.2, APIs: 1, Strings: 2, Instructions: 954registryCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 21146 6502f0-6503ad call 673bc0 call 673b90 call 620500 call 679e00 call 673810 21157 6503b3-6503ea call 675d50 call 6127a0 RegOpenKeyExA 21146->21157 21162 651144-651168 call 612660 21157->21162 21163 6503f0-650428 call 6eef60 21157->21163 21162->21157 21168 65116e-651186 21162->21168 21170 65042e 21163->21170 21171 65113b-651143 21163->21171 21172 650430-65044d 21170->21172 21171->21162 21175 650453-650512 call 6eef60 * 5 21172->21175 21176 6510fd-651135 call 6eef60 21172->21176 21190 650516-650521 21175->21190 21176->21171 21176->21172 21190->21190 21191 650523-650549 21190->21191 21193 6510f4-6510fc 21191->21193 21194 65054f-6505ac 21191->21194 21193->21176 21195 6505b2-6505b7 21194->21195 21195->21195 21197 6505b9-65062a call 612830 call 6eef60 * 2 21195->21197 21204 650630-65063b 21197->21204 21204->21204 21205 65063d-650663 21204->21205 21207 650665-6506b4 call 61d9b0 21205->21207 21208 6506b6-6506bd 21205->21208 21207->21208 21215 65070d-65072e 21207->21215 21209 6506bf-6506c5 21208->21209 21210 6506db-6506e2 21208->21210 21213 6506c8-6506cd 21209->21213 21214 6506e4-6506ed 21210->21214 21210->21215 21213->21213 21217 6506cf-6506d1 21213->21217 21218 6506f0-6506f5 21214->21218 21216 650730-65073b 21215->21216 21216->21216 21219 65073d-650760 21216->21219 21217->21210 21221 6506d3-6506d9 21217->21221 21218->21218 21222 6506f7-6506f9 21218->21222 21227 650766-6507bb call 61a6c0 21219->21227 21228 650873-65087a 21219->21228 21223 650701-650708 call 675b70 21221->21223 21222->21215 21224 6506fb 21222->21224 21223->21215 21224->21223 21227->21228 21250 6507c1-650816 call 61a6c0 21227->21250 21229 6508bd-6508c4 21228->21229 21230 65087c-650882 21228->21230 21234 6508c6-6508cf 21229->21234 21235 650908-65090f 21229->21235 21232 650885-65088a 21230->21232 21232->21232 21236 65088c-65088e 21232->21236 21239 6508d0-6508d5 21234->21239 21237 650911-65091a 21235->21237 21238 65095b-650962 21235->21238 21236->21229 21240 650890-6508b8 call 61b830 call 675b70 21236->21240 21241 650920-650925 21237->21241 21243 650964-65096d 21238->21243 21244 6509ba-650a1c call 675880 * 2 call 6758a0 call 67a830 call 6758c0 21238->21244 21239->21239 21245 6508d7-6508d9 21239->21245 21271 6509ac-6509b7 call 62ff60 21240->21271 21241->21241 21249 650927-650929 21241->21249 21246 650970-650975 21243->21246 21288 650a21-650aaf call 677750 call 6ecd02 call 675d50 21244->21288 21245->21235 21247 6508db-650903 call 61b830 call 675b70 21245->21247 21246->21246 21252 650977-650979 21246->21252 21247->21271 21249->21238 21255 65092b-650959 call 61b830 call 675b70 21249->21255 21250->21228 21279 650818-65086d call 61a6c0 21250->21279 21252->21244 21258 65097b-6509a6 call 61b830 call 675b70 21252->21258 21255->21271 21258->21271 21271->21244 21279->21228 21279->21288 21295 650ab3-650abe 21288->21295 21295->21295 21296 650ac0-650acc 21295->21296 21297 650afc-650afe 21296->21297 21298 650ace-650afa call 677750 21296->21298 21299 650b04 21297->21299 21300 651187-6511da call 677a20 call 612700 call 679bb0 call 618920 call 6ee96b 21297->21300 21302 650b0a-650b2e 21298->21302 21299->21302 21325 6511df-6511e4 call 6f2220 21300->21325 21305 650b31-650b36 21302->21305 21305->21305 21308 650b38-650b6b call 612830 call 67cf10 21305->21308 21318 650b6d-650b7c 21308->21318 21319 650b9c-650c5e call 6737f0 call 6ecd02 call 675d50 21308->21319 21321 650b92-650b99 call 6ecf83 21318->21321 21322 650b7e-650b8c 21318->21322 21334 650c60-650c6b 21319->21334 21321->21319 21322->21321 21322->21325 21334->21334 21335 650c6d-650c92 21334->21335 21336 650c95-650c9a 21335->21336 21336->21336 21337 650c9c-650cd0 call 612830 call 67cf10 21336->21337 21342 650d01-650d9e call 6737f0 call 6ecd02 21337->21342 21343 650cd2-650ce1 21337->21343 21352 650da5-650daa 21342->21352 21345 650cf7-650cfe call 6ecf83 21343->21345 21346 650ce3-650cf1 21343->21346 21345->21342 21346->21325 21346->21345 21352->21352 21353 650dac-650de0 call 612830 21352->21353 21356 650de4-650def 21353->21356 21356->21356 21357 650df1-650e19 21356->21357 21358 650e20-650e25 21357->21358 21358->21358 21359 650e27-650e5b call 612830 call 67cf10 21358->21359 21364 650e5d-650e6c 21359->21364 21365 650e8c-650f51 call 6737f0 call 6ecd02 call 675d50 21359->21365 21366 650e82-650e89 call 6ecf83 21364->21366 21367 650e6e-650e7c 21364->21367 21376 650f57-650f62 21365->21376 21366->21365 21367->21325 21367->21366 21376->21376 21377 650f64-650f8c 21376->21377 21378 650f90-650f95 21377->21378 21378->21378 21379 650f97-650fcb call 612830 call 67cf10 21378->21379 21384 650fcd-650fdc 21379->21384 21385 650ffc-65105f call 6737f0 21379->21385 21386 650ff2-650ff9 call 6ecf83 21384->21386 21387 650fde-650fec 21384->21387 21392 651060-65106b 21385->21392 21386->21385 21387->21325 21387->21386 21392->21392 21393 65106d-6510a2 call 679e00 call 673170 call 6737f0 21392->21393 21400 6510a4-6510b2 call 6127b0 21393->21400 21401 6510b7-6510ee call 612660 * 2 21393->21401 21400->21401 21401->21193
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,007461C0,00000000), ref: 006503E2
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • bt, xrefs: 00651162
                                                                                                                                                                                                  • cannot use operator[] with a string argument with , xrefs: 0065119F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Open
                                                                                                                                                                                                  • String ID: bt$cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 71445658-3999845875
                                                                                                                                                                                                  • Opcode ID: 02d1ffd490b4c260ad5f307b8969b419ad5d29df51ed4d2b956436701bf38b16
                                                                                                                                                                                                  • Instruction ID: d7a28d111968128dbac9476785a83b6c7ba9134c39bf91eb8a3b8303dd5341e4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 02d1ffd490b4c260ad5f307b8969b419ad5d29df51ed4d2b956436701bf38b16
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5492BB70C00258DEEB65CB64CC94BEDBBBAAF19304F1481DDD449A7282EB755B88CF61
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0062DB60 Relevance: 6.1, APIs: 4, Instructions: 99networkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 21407 62db60-62db92 WSAStartup 21408 62dc66-62dc6f 21407->21408 21409 62db98-62dbc2 call 617d20 * 2 21407->21409 21414 62dbc4-62dbc8 21409->21414 21415 62dbce-62dc14 21409->21415 21414->21408 21414->21415 21417 62dc60 21415->21417 21418 62dc16-62dc1c 21415->21418 21417->21408 21419 62dc74-62dc7e 21418->21419 21420 62dc1e 21418->21420 21419->21417 21426 62dc80-62dc88 21419->21426 21421 62dc24-62dc38 socket 21420->21421 21421->21417 21422 62dc3a-62dc4a connect 21421->21422 21424 62dc70 21422->21424 21425 62dc4c-62dc54 closesocket 21422->21425 21424->21419 21425->21421 21427 62dc56-62dc5f 21425->21427 21427->21417
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WSAStartup.WS2_32 ref: 0062DB8B
                                                                                                                                                                                                  • socket.WS2_32(?,?,?,?,?,?,007460D8,?,?), ref: 0062DC2D
                                                                                                                                                                                                  • connect.WS2_32(00000000,?,?,?,?,?,007460D8,?,?), ref: 0062DC42
                                                                                                                                                                                                  • closesocket.WS2_32(00000000), ref: 0062DC4D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Startupclosesocketconnectsocket
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3098855095-0
                                                                                                                                                                                                  • Opcode ID: 70aacef9ea5cd9798b1f84618a629cfe81b70fc9f4bd70f400429339667e67d2
                                                                                                                                                                                                  • Instruction ID: b379693a646351d74bf80b1d2aeed8d40af24ab692934b4f66f59a76ad8fdd05
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70aacef9ea5cd9798b1f84618a629cfe81b70fc9f4bd70f400429339667e67d2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2231E4726047556BC7209B28DC89A7FB7EAFFC5334F105B1DF8A4A32D0E37099048A92
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00621370 Relevance: 5.5, APIs: 2, Instructions: 2459COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 006213C5
                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 006213EC
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FolderPath
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1514166925-0
                                                                                                                                                                                                  • Opcode ID: ccfccabac0b20b371cdbf331b86502913467eaa40ed5700e3fa0dc685b52ca10
                                                                                                                                                                                                  • Instruction ID: bce6431cb04c36e13efed9e6e9954d6c04c02f41e3e9a5b1f1e623b23d045e6a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ccfccabac0b20b371cdbf331b86502913467eaa40ed5700e3fa0dc685b52ca10
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7033F470C04269DADF61EB64CC657EDBB76AF21304F4841DCD44967282EB701B89CFAA
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0062FF60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109encryptionCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 22696 62ff60-62ff7e 22697 62ff80-62ff9c CryptUnprotectData 22696->22697 22698 62ffa9-62ffaf 22697->22698 22699 62ff9e-62ffa7 22697->22699 22700 62ffb1-62ffc2 call 6fb99c 22698->22700 22701 62ffce-62ffd5 22698->22701 22699->22697 22699->22698 22704 62ffd6-63003d call 6eef60 call 6ee9e0 call 612830 call 675bd0 22700->22704 22705 62ffc4-62ffcd 22700->22705 22715 630068-630082 call 6fb246 22704->22715 22716 63003f-63004c 22704->22716 22705->22701 22717 63005e-630065 call 6ecf83 22716->22717 22718 63004e-63005c 22716->22718 22717->22715 22718->22717 22720 630083-630088 call 6f2220 22718->22720
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0062FF98
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • nhhw, xrefs: 006326C1
                                                                                                                                                                                                  • cannot use operator[] with a string argument with , xrefs: 0063465D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CryptDataUnprotect
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with $nhhw
                                                                                                                                                                                                  • API String ID: 834300711-2438394525
                                                                                                                                                                                                  • Opcode ID: 6f59344b1c2c978f2e6d3479fa2d12fe5ffd283a17a7f1c1bd6b14aa16dbd333
                                                                                                                                                                                                  • Instruction ID: 78aca0cf24243469375402389b0bea560f3ff4510fdce6c6293ca3939d9fca38
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f59344b1c2c978f2e6d3479fa2d12fe5ffd283a17a7f1c1bd6b14aa16dbd333
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 982135729043046BE254AB24DC46BAFB7AABFD5710F00463DF88893280EB7599498BD7
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00635A30 Relevance: 5.3, Strings: 2, Instructions: 2804COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                  • String ID: 49+>$xKHX
                                                                                                                                                                                                  • API String ID: 1620887387-1200208320
                                                                                                                                                                                                  • Opcode ID: ef4c1ca2a84b6c0e5e7a0c55eda3b9747da8b6b27e93bbd3393e7eae9d6257aa
                                                                                                                                                                                                  • Instruction ID: 723c4904d0812a1bca72e7bf8369411e88e335259512b48e244f41ea93647423
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ef4c1ca2a84b6c0e5e7a0c55eda3b9747da8b6b27e93bbd3393e7eae9d6257aa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1D43DD70D042598BDB25DF24C855BEEBBB2AF15304F1481DCE449A7382EB74AB88CF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006475F0 Relevance: 5.3, Strings: 3, Instructions: 1514COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: ;-4$cannot use operator[] with a string argument with $sx9'
                                                                                                                                                                                                  • API String ID: 0-2626169165
                                                                                                                                                                                                  • Opcode ID: 412639263dbaa39e0969d71daa00a1154d75fc4512a05c699022d09b1863bd6a
                                                                                                                                                                                                  • Instruction ID: 77b8ddb813a4220e639e24b173579a90c66feab3eab9001d1594d6708ad67b0e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 412639263dbaa39e0969d71daa00a1154d75fc4512a05c699022d09b1863bd6a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69D2D270D002588FDB29CB28CC55BEDBBB6AF55304F1482DCE449A7282DB749E89CF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00640260 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 975COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • std::locale::_Init.LIBCPMT ref: 0064091E
                                                                                                                                                                                                    • Part of subcall function 00679110: std::_Lockit::_Lockit.LIBCPMT ref: 0067913E
                                                                                                                                                                                                    • Part of subcall function 00679110: std::_Lockit::_Lockit.LIBCPMT ref: 00679161
                                                                                                                                                                                                    • Part of subcall function 00679110: std::_Lockit::~_Lockit.LIBCPMT ref: 00679181
                                                                                                                                                                                                    • Part of subcall function 00679110: std::_Lockit::~_Lockit.LIBCPMT ref: 006791B5
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Lockitstd::_$Lockit::_Lockit::~_$Initstd::locale::_
                                                                                                                                                                                                  • String ID: n:
                                                                                                                                                                                                  • API String ID: 1226965381-2748301705
                                                                                                                                                                                                  • Opcode ID: 1440569758a9678044326fd77ea43aff29ac0ff3ef20cc16b3a0bed7d97c92cc
                                                                                                                                                                                                  • Instruction ID: 640a16cb7da96078ec5f8b2489801041b0e999e6b87ae144b7c8304c573a390a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1440569758a9678044326fd77ea43aff29ac0ff3ef20cc16b3a0bed7d97c92cc
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EC820670D00258CFEB18DF68C8997EDBBB2BF45304F14829DE405AB392DB749A84CB95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00663290 Relevance: 4.1, Strings: 3, Instructions: 334COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID: 0bt$Xat$pbt
                                                                                                                                                                                                  • API String ID: 118556049-3796763089
                                                                                                                                                                                                  • Opcode ID: 54b5853a93e6a605ac231c2f1b9a54b45da8fd229c36ade50b1f58875347411e
                                                                                                                                                                                                  • Instruction ID: f69c25540cbaf400a563569ea3d310728845fc6786fa3a232136918ca27c8f47
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 54b5853a93e6a605ac231c2f1b9a54b45da8fd229c36ade50b1f58875347411e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 57E1F3B4D04298CFCB45DBA8C8457DDFBB6AF5A300F14809DE449A7352EB349A44CFA6
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0063BA00 Relevance: 3.7, Strings: 1, Instructions: 2456COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • cannot use operator[] with a string argument with , xrefs: 0063DDC0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 1620887387-2766135566
                                                                                                                                                                                                  • Opcode ID: ee8540107528245b6d8b583161a5aed5116c865055dc6ed2ef945dc4935cb92c
                                                                                                                                                                                                  • Instruction ID: 773fa537129fae63a1f2c72ee959ed8a10a216d491ef6f2b1934440f2140c3e5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee8540107528245b6d8b583161a5aed5116c865055dc6ed2ef945dc4935cb92c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C23EF70D002588BDB18DF68CC94BEDBBB2AF55304F1482DCE449AB292DB746B85CF95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00640F50 Relevance: 3.3, Strings: 1, Instructions: 2004COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 0-2766135566
                                                                                                                                                                                                  • Opcode ID: 6aa0eedd445e4305d4204b5a57099fd5e7b3e111b1b6ca2b23fdc38ae8a3b47c
                                                                                                                                                                                                  • Instruction ID: 8e9ba9a9ac6d9621e4a5ca6904401b2a598bf7d8730374fb241709884e5b0da6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6aa0eedd445e4305d4204b5a57099fd5e7b3e111b1b6ca2b23fdc38ae8a3b47c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6F03D071D002598BDF18CF68CC947EDBBB2AF45300F6482DDE449AB692DB709AC5CB94
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006346D0 Relevance: 2.7, Strings: 1, Instructions: 1419COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • cannot use operator[] with a string argument with , xrefs: 006359E6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 0-2766135566
                                                                                                                                                                                                  • Opcode ID: 671206551dbd3c01909ba38f053ac2809b2ec2f5aa96d777e55010c83a3ed8b4
                                                                                                                                                                                                  • Instruction ID: d547805c954bac6338d71f4826148de8d42bdc080ecd9132962a979cee913b34
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 671206551dbd3c01909ba38f053ac2809b2ec2f5aa96d777e55010c83a3ed8b4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 68C2C071D002598BDB18CF68CC947EDFBB2BF55304F14829CD44AAB392DB74AA85CB91
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00646530 Relevance: 2.4, Strings: 1, Instructions: 1179COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock
                                                                                                                                                                                                  • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                                                  • API String ID: 1418687624-2766135566
                                                                                                                                                                                                  • Opcode ID: 3af3bd04d3d9cb0d1b24d019567b07e43665215debb2e70deb6c7708ccdd5002
                                                                                                                                                                                                  • Instruction ID: 76d1a5477cac2b29bc37113517c6688ca1b8231a46214db43d13ca4776e38d40
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3af3bd04d3d9cb0d1b24d019567b07e43665215debb2e70deb6c7708ccdd5002
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3DB2F4709042588FDB24DF64CC55BEEBBB6AF15304F1481DCE449AB282EB759B88CF91
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0063DE10 Relevance: 2.1, Instructions: 2085COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1620887387-0
                                                                                                                                                                                                  • Opcode ID: 37468f5b06e21a8db73782838ff8e9abe80ad393e3fef5da24d1c71c93deeb60
                                                                                                                                                                                                  • Instruction ID: a682f3e044f8c575e8a2c30582e154d64e67b52140d3d84dfaec3e3ab18355d5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 37468f5b06e21a8db73782838ff8e9abe80ad393e3fef5da24d1c71c93deeb60
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5613D171C002588BEB18CF68CD95BEEBBB6BF55304F1482DCE4496B292D7745B85CBA0
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00640830 Relevance: 2.1, APIs: 1, Instructions: 554COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0061B890: __fread_nolock.LIBCMT ref: 0061B97F
                                                                                                                                                                                                  • std::locale::_Init.LIBCPMT ref: 0064091E
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Init__fread_nolockstd::locale::_
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 221842284-0
                                                                                                                                                                                                  • Opcode ID: dc9815c8639e3935011cfb746d84d4aa4029177b267e5748e489f2db7d307cd0
                                                                                                                                                                                                  • Instruction ID: 350355bfc0ebcbefc6decdd2218cb76717cb8e904ddc22800f0ac7189eae39f7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dc9815c8639e3935011cfb746d84d4aa4029177b267e5748e489f2db7d307cd0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1622F571D00258CBEB18DF68CD897EDBBB2BF45304F14829CD809AB392D7749A85CB95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006A44E0 Relevance: 2.0, APIs: 1, Instructions: 471COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A4976
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 885266447-0
                                                                                                                                                                                                  • Opcode ID: 769567b72632514e62fc30244089d2d63fa7a791f169981723ac3bb85654988e
                                                                                                                                                                                                  • Instruction ID: 40dbc1df74a1777fe1adcf517d13b0837ca64f9d246c95b9e46d3f74fdd951a1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 769567b72632514e62fc30244089d2d63fa7a791f169981723ac3bb85654988e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E0266706047418FDB64EB29C840BA7B7E2AFCA304F14492DE48ACB751EBB5ED458F52
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0062FE80 Relevance: 1.6, APIs: 1, Instructions: 123encryptionCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0062FF98
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CryptDataUnprotect
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 834300711-0
                                                                                                                                                                                                  • Opcode ID: 38004c2111e4e40764f39972abde4b5c7c82c4f97c6765e212fe76cd999b235c
                                                                                                                                                                                                  • Instruction ID: 1636523c569bcaca7380b5fdc6f0ce8b0f1417e828b9224ab3e96a8e0d33ffad
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 38004c2111e4e40764f39972abde4b5c7c82c4f97c6765e212fe76cd999b235c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C8315772400A104BE3389B38ED487AAB7E7EF41320F144A3DF8958BF91D674E9848F95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006EB3B5 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,00682CFA,?,761B23A0), ref: 006EB3D0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileFindFirst
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1974802433-0
                                                                                                                                                                                                  • Opcode ID: d521af41fad93dcedbf6c1e6d586b3c58fbc44669a89bfd31efb70d2f2c0d209
                                                                                                                                                                                                  • Instruction ID: c768c8a52d4cd7acc6317bbafb54aedb56e3cfa915868ca99a09751b6780c119
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d521af41fad93dcedbf6c1e6d586b3c58fbc44669a89bfd31efb70d2f2c0d209
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9FE08C32115344BFEB116F799C46CBFB79EDB06360B205A25B854D21A0D7B28C619660
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006F95DD Relevance: .3, Instructions: 318COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 2e0b7442c5f62023e354a77df4d12a2dc3123c91d8a1577ee055a4a67bfb94ce
                                                                                                                                                                                                  • Instruction ID: cf44ef0b4388ae87eae1d3732ea8d2d06ccd6f4a66991c446623729df7db8822
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2e0b7442c5f62023e354a77df4d12a2dc3123c91d8a1577ee055a4a67bfb94ce
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F3B1BF7090060E8BDB24DF688965BFEBBA7AF05304F24061ED762D7791C631AA06CB71
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0062E060 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 333networkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 15157 62e060-62e0af call 675d50 15160 62e1d4-62e20a call 675bd0 15157->15160 15161 62e0b5-62e0b8 15157->15161 15170 62e238-62e26c call 617d20 15160->15170 15171 62e20c-62e218 15160->15171 15162 62e0c0-62e0e6 15161->15162 15164 62e0f8-62e107 15162->15164 15165 62e0e8-62e0f3 15162->15165 15168 62e117-62e123 15164->15168 15169 62e109-62e112 15164->15169 15167 62e1c7 15165->15167 15173 62e1ca-62e1ce 15167->15173 15174 62e133-62e13f 15168->15174 15175 62e125-62e12e 15168->15175 15169->15167 15183 62e282-62e28a call 678610 15170->15183 15184 62e26e-62e280 15170->15184 15176 62e21a-62e228 15171->15176 15177 62e22e-62e235 call 6ecf83 15171->15177 15173->15160 15173->15162 15179 62e141-62e14a 15174->15179 15180 62e14c-62e158 15174->15180 15175->15167 15176->15177 15181 62e44b call 6f2220 15176->15181 15177->15170 15179->15167 15185 62e165-62e171 15180->15185 15186 62e15a-62e163 15180->15186 15191 62e450-62e455 call 6f2220 15181->15191 15189 62e28f-62e2e2 call 617d20 * 2 15183->15189 15184->15189 15192 62e173-62e17c 15185->15192 15193 62e17e-62e18a 15185->15193 15186->15167 15205 62e316-62e32c call 617d20 15189->15205 15206 62e2e4-62e313 call 617d20 call 6ee9e0 15189->15206 15192->15167 15194 62e197-62e1a3 15193->15194 15195 62e18c-62e195 15193->15195 15198 62e1b0-62e1b9 15194->15198 15199 62e1a5-62e1ae 15194->15199 15195->15167 15198->15173 15202 62e1bb-62e1c3 15198->15202 15199->15167 15202->15167 15211 62e332-62e338 15205->15211 15212 62e3b7 15205->15212 15206->15205 15214 62e340-62e36c 15211->15214 15215 62e3bb-62e3c1 15212->15215 15217 62e370-62e37b 15214->15217 15218 62e3c3-62e3cf 15215->15218 15219 62e3eb-62e403 15215->15219 15217->15217 15222 62e37d-62e3ab WSASend 15217->15222 15223 62e3e1-62e3e8 call 6ecf83 15218->15223 15224 62e3d1-62e3df 15218->15224 15220 62e435-62e44a 15219->15220 15221 62e405-62e411 15219->15221 15226 62e413-62e421 15221->15226 15227 62e42b-62e432 call 6ecf83 15221->15227 15234 62e425-62e429 15222->15234 15235 62e3ad-62e3b5 15222->15235 15223->15219 15224->15191 15224->15223 15226->15191 15229 62e423 15226->15229 15227->15220 15229->15227 15234->15215 15235->15212 15235->15214
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,007147E8,00000000,00000000,-007465B0), ref: 0062E3A6
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Send
                                                                                                                                                                                                  • String ID: 2/g$2/g$2/g$2/g$Ws2_32.dll$\;t$t;t$tat$;t
                                                                                                                                                                                                  • API String ID: 121738739-3201010165
                                                                                                                                                                                                  • Opcode ID: de1cd8912e348bcf27489e79fd3dead44c16ba4550003611b9b9cbbf3bf41e7a
                                                                                                                                                                                                  • Instruction ID: 45b99838a19976f45d115cca4fb6e4f796b165a14457f42b23757e7b4d226110
                                                                                                                                                                                                  • Opcode Fuzzy Hash: de1cd8912e348bcf27489e79fd3dead44c16ba4550003611b9b9cbbf3bf41e7a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FBD1EE31E04A58DFDB14CBA8DC54BEDBBF2AF05300F68426CD455AB2C2E7709986CB95
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0062EC20 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 265networksleepCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 15236 62ec20-62ec58 15237 62ec5e 15236->15237 15238 62f0bf-62f0d3 15236->15238 15239 62ec64-62ec6c 15237->15239 15240 62eca7-62ecf0 setsockopt recv 15239->15240 15241 62ec6e-62ec94 call 62db60 15239->15241 15240->15238 15246 62ecf6-62ecf9 15240->15246 15243 62ec99-62eca1 15241->15243 15243->15240 15245 62f0aa-62f0b9 Sleep 15243->15245 15245->15238 15245->15239 15247 62f037-62f053 call 624a90 15246->15247 15248 62ecff-62ed53 call 678610 recv 15246->15248 15253 62f055 15247->15253 15254 62f09c-62f0a4 Sleep 15247->15254 15258 62efe4-62eff1 15248->15258 15259 62ed59-62ed74 recv 15248->15259 15256 62f057-62f05d 15253->15256 15257 62f05f-62f086 call 62e060 15253->15257 15254->15245 15256->15254 15256->15257 15265 62f08b-62f097 15257->15265 15258->15254 15260 62eff7-62f003 15258->15260 15259->15258 15262 62ed7a-62edb1 15259->15262 15263 62f005-62f013 15260->15263 15264 62f019-62f023 call 6ecf83 15260->15264 15266 62edb3-62ee11 call 678610 setsockopt recv 15262->15266 15267 62ee14-62ee44 call 675d50 15262->15267 15263->15264 15264->15254 15265->15254 15266->15267 15274 62ef64-62efa1 call 62e460 15267->15274 15275 62ee4a 15267->15275 15279 62efa6-62efb3 15274->15279 15276 62ee50-62ef5e 15275->15276 15276->15274 15279->15258 15281 62efb5-62efc4 15279->15281 15282 62efc6-62efd4 15281->15282 15283 62efda-62efe1 call 6ecf83 15281->15283 15282->15283 15283->15258
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • setsockopt.WS2_32(000003A8,0000FFFF,00001006,?,00000008), ref: 0062ECC7
                                                                                                                                                                                                  • recv.WS2_32(?,00000004,00000002), ref: 0062ECE1
                                                                                                                                                                                                  • recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 0062ED4E
                                                                                                                                                                                                  • recv.WS2_32(00000000,0000000C,00000008), ref: 0062ED6F
                                                                                                                                                                                                  • setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?,00000000), ref: 0062EDEB
                                                                                                                                                                                                  • recv.WS2_32(00000000,?,00000008), ref: 0062EE0C
                                                                                                                                                                                                    • Part of subcall function 0062DB60: WSAStartup.WS2_32 ref: 0062DB8B
                                                                                                                                                                                                    • Part of subcall function 0062DB60: socket.WS2_32(?,?,?,?,?,?,007460D8,?,?), ref: 0062DC2D
                                                                                                                                                                                                    • Part of subcall function 0062DB60: connect.WS2_32(00000000,?,?,?,?,?,007460D8,?,?), ref: 0062DC42
                                                                                                                                                                                                    • Part of subcall function 0062DB60: closesocket.WS2_32(00000000), ref: 0062DC4D
                                                                                                                                                                                                  • recv.WS2_32(?,00000004,00000008), ref: 0062F033
                                                                                                                                                                                                  • Sleep.KERNEL32(00000001), ref: 0062F09E
                                                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 0062F0AC
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0062F211
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: recv$Sleepsetsockopt$Mtx_unlockStartupclosesocketconnectsocket
                                                                                                                                                                                                  • String ID: t;t
                                                                                                                                                                                                  • API String ID: 279929529-3345171331
                                                                                                                                                                                                  • Opcode ID: 5741148ccd409b703c0cbefce9745a3f23b24cb1cbbe7e5421c126843010780b
                                                                                                                                                                                                  • Instruction ID: 09225b8bda9cf32d6850a2422b47931cb2716060898faf2e5bf2a85465c7c6f7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5741148ccd409b703c0cbefce9745a3f23b24cb1cbbe7e5421c126843010780b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FCB1E131D00658DFEB20DBA8DC54BADB7B2FF45300F24826AE454AB2D2D7756985CF81
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00690430 Relevance: 12.2, APIs: 8, Instructions: 230networkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 16722 690430-69047f 16723 690481-690494 16722->16723 16724 690496-6904a8 call 681030 16722->16724 16725 6904ab-6904cd call 6754b0 16723->16725 16724->16725 16730 6904fd-690510 16725->16730 16731 6904cf-6904e1 16725->16731 16732 6904f3-6904fa call 6ecf83 16731->16732 16733 6904e3-6904f1 16731->16733 16732->16730 16733->16732 16734 690513-690544 call 6f2220 InternetOpenA 16733->16734 16739 690550-690589 InternetSetOptionA 16734->16739 16740 690546-69054f 16734->16740 16742 69058b-690592 16739->16742 16743 690597-6905ac 16739->16743 16742->16743 16744 6905b0-6905bb 16743->16744 16744->16744 16745 6905bd-6905e9 HttpOpenRequestA 16744->16745 16747 690648-690679 16745->16747 16748 6905eb-690608 call 617d20 16745->16748 16752 69067b-69067c InternetCloseHandle 16747->16752 16753 690682-690684 16747->16753 16757 69060a-69060d 16748->16757 16758 690645 16748->16758 16752->16753 16755 69068d-69069d InternetCloseHandle 16753->16755 16756 690686-690687 InternetCloseHandle 16753->16756 16756->16755 16757->16758 16759 69060f-690612 16757->16759 16758->16747 16759->16758 16760 690614-69063f InternetQueryOptionA InternetSetOptionA 16759->16760 16760->16758
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • InternetOpenA.WININET(?,00000000,00000000,00000000,00000000,?,00000000), ref: 0069053E
                                                                                                                                                                                                  • InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 00690559
                                                                                                                                                                                                  • HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,80000000,00000000), ref: 006905D2
                                                                                                                                                                                                  • InternetQueryOptionA.WININET(00000000,0000001F,?,?), ref: 00690629
                                                                                                                                                                                                  • InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0069063F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Internet$Option$Open$HttpQueryRequest
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 694232940-0
                                                                                                                                                                                                  • Opcode ID: 0e83f3b6589935bde58f89cac211728dc890d4ee391db1a879b4794f53837d5e
                                                                                                                                                                                                  • Instruction ID: a772d26214fcaf5b0fd1f70c44410c8ce51753b69f5e8df42e23fd6c3c06d9e6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0e83f3b6589935bde58f89cac211728dc890d4ee391db1a879b4794f53837d5e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50710771A00209AFEB14DF54DC45FEEB7B9EF49710F20411AFA05A73C1D774AA048BA5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0067C4E0 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 519COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 17759 67c4e0-67c524 17760 67c993-67c9cc call 6845c0 call 67e6c0 17759->17760 17761 67c52a-67c5c2 17759->17761 17771 67c9d2-67ca66 call 67da50 call 618080 call 67e100 call 685a50 17760->17771 17772 67cb5c-67cb60 17760->17772 17766 67c5d7-67c617 call 677750 call 67eb30 17761->17766 17767 67c5c4-67c5d1 17761->17767 17783 67c636-67c65e call 6834c0 call 67e6c0 17766->17783 17784 67c619-67c62c 17766->17784 17767->17766 17807 67ca94-67cae2 call 6ee124 * 2 17771->17807 17808 67ca68-67ca74 17771->17808 17775 67cb62-67cb9f call 677750 call 6737f0 17772->17775 17776 67cbad-67cbb2 17772->17776 17781 67c8b4-67c8c6 17775->17781 17798 67cba5 17775->17798 17776->17781 17782 67cbb8 17776->17782 17787 67cbc0 call 6f2220 17782->17787 17804 67c664-67c6f8 call 67da50 call 618080 call 67e100 call 684580 17783->17804 17805 67c7e9-67c7f0 17783->17805 17784->17783 17796 67cbc5 call 6f2220 17787->17796 17803 67cbca-67cbd9 call 6f2220 17796->17803 17798->17776 17825 67cc03-67cc16 17803->17825 17826 67cbdb-67cbe5 17803->17826 17869 67c726-67c771 call 6ee124 * 2 17804->17869 17870 67c6fa-67c706 17804->17870 17810 67c7f6-67c841 call 677750 call 6737f0 * 2 17805->17810 17811 67c8c9-67c8cc 17805->17811 17847 67cae4-67caf3 17807->17847 17848 67cb13-67cb32 17807->17848 17815 67ca76-67ca84 17808->17815 17816 67ca8a-67ca91 call 6ecf83 17808->17816 17863 67c843-67c857 17810->17863 17864 67c861-67c87f call 672f00 * 2 17810->17864 17813 67c8ce-67c905 call 677750 call 6737f0 17811->17813 17814 67c90a-67c91d call 6737f0 17811->17814 17813->17814 17839 67c91f-67c933 17814->17839 17840 67c93d-67c95b call 672f00 * 2 17814->17840 17815->17803 17815->17816 17816->17807 17833 67cbe7-67cbf5 17826->17833 17834 67cbf9-67cbfb call 6ecf83 17826->17834 17842 67cc17-67cc1f call 6f2220 17833->17842 17843 67cbf7 17833->17843 17850 67cc00 17834->17850 17839->17840 17840->17781 17880 67c961-67c974 17840->17880 17843->17834 17858 67caf5-67cb03 17847->17858 17859 67cb09-67cb10 call 6ecf83 17847->17859 17848->17772 17853 67cb34-67cb40 17848->17853 17850->17825 17861 67cb52-67cb59 call 6ecf83 17853->17861 17862 67cb42-67cb50 17853->17862 17858->17803 17858->17859 17859->17848 17861->17772 17862->17803 17862->17861 17863->17864 17864->17781 17891 67c881-67c894 17864->17891 17895 67c773-67c77f 17869->17895 17896 67c79f-67c7bb 17869->17896 17876 67c71c-67c723 call 6ecf83 17870->17876 17877 67c708-67c716 17870->17877 17876->17869 17877->17787 17877->17876 17881 67c8aa-67c8b1 call 6ecf83 17880->17881 17882 67c97a-67c988 17880->17882 17881->17781 17882->17796 17886 67c98e 17882->17886 17886->17881 17891->17881 17894 67c896-67c8a4 17891->17894 17894->17796 17894->17881 17898 67c795-67c79c call 6ecf83 17895->17898 17899 67c781-67c78f 17895->17899 17896->17805 17897 67c7bd-67c7c9 17896->17897 17901 67c7df-67c7e6 call 6ecf83 17897->17901 17902 67c7cb-67c7d9 17897->17902 17898->17896 17899->17787 17899->17898 17901->17805 17902->17787 17902->17901
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 0067C746
                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 0067C75F
                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 0067CAB7
                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 0067CAD0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ___std_exception_destroy
                                                                                                                                                                                                  • String ID: value
                                                                                                                                                                                                  • API String ID: 4194217158-494360628
                                                                                                                                                                                                  • Opcode ID: 5ef62b5dc54f2872d0d478dca06280a5798db4447d65b691467ee42941020437
                                                                                                                                                                                                  • Instruction ID: f10232cc42d7691e9717b4595e66e7fe17e94aa1bd9480eeba739e4ec27dd5d0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ef62b5dc54f2872d0d478dca06280a5798db4447d65b691467ee42941020437
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE22C171D00248CFDB18CB68C895BEDBBB2AF49310F14C29DE449A7782DB746A85CF65
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0061B890 Relevance: 4.9, APIs: 3, Instructions: 352COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 24210 61b890-61b8ed 24211 61b8f4-61b8ff 24210->24211 24211->24211 24212 61b901-61b922 call 6f2dd0 24211->24212 24215 61b924-61b94c call 6f6ba6 call 6f295b call 6f6ba6 24212->24215 24216 61b98d-61b994 24212->24216 24233 61b961-61b968 call 678610 24215->24233 24234 61b94e-61b954 24215->24234 24218 61b996-61b9a2 24216->24218 24219 61b9be-61b9ce 24216->24219 24221 61b9b4-61b9bb call 6ecf83 24218->24221 24222 61b9a4-61b9b2 24218->24222 24221->24219 24222->24221 24223 61b9cf-61ba1d call 6f2220 call 679d30 24222->24223 24239 61ba24-61ba2f 24223->24239 24241 61b96d 24233->24241 24236 61b956 24234->24236 24237 61b958-61b95f 24234->24237 24236->24237 24240 61b970-61b976 24237->24240 24239->24239 24242 61ba31-61ba52 call 6f2dd0 24239->24242 24243 61b978 24240->24243 24244 61b97a-61b985 call 6fb64f call 6f6658 24240->24244 24241->24240 24249 61ba54-61ba7e call 6f6ba6 call 6f295b call 6f6ba6 24242->24249 24250 61baba-61bac1 24242->24250 24243->24244 24257 61b98a 24244->24257 24269 61ba90-61ba97 call 678610 24249->24269 24270 61ba80-61ba84 24249->24270 24251 61bac3-61bacf 24250->24251 24252 61baeb-61bafb 24250->24252 24255 61bae1-61bae8 call 6ecf83 24251->24255 24256 61bad1-61badf 24251->24256 24255->24252 24256->24255 24260 61bafc-61bb4d call 6f2220 call 679d30 24256->24260 24257->24216 24275 61bb54-61bb5f 24260->24275 24276 61ba9c-61baa2 24269->24276 24272 61ba86 24270->24272 24273 61ba88-61ba8e 24270->24273 24272->24273 24273->24276 24275->24275 24277 61bb61-61bb82 call 6f2dd0 24275->24277 24278 61baa4 24276->24278 24279 61baa6-61baab call 6fb64f 24276->24279 24283 61bbf4-61bbfb 24277->24283 24284 61bb84-61bbb8 call 6f6ba6 call 6f295b call 6f6ba6 24277->24284 24278->24279 24285 61bab0-61bab9 call 6f6658 24279->24285 24287 61bc25-61bc35 24283->24287 24288 61bbfd-61bc09 24283->24288 24303 61bbca-61bbd1 call 678610 24284->24303 24304 61bbba-61bbbe 24284->24304 24285->24250 24291 61bc1b-61bc22 call 6ecf83 24288->24291 24292 61bc0b-61bc19 24288->24292 24291->24287 24292->24291 24295 61bc36-61bc3b call 6f2220 24292->24295 24308 61bbd6-61bbdc 24303->24308 24305 61bbc0 24304->24305 24306 61bbc2-61bbc8 24304->24306 24305->24306 24306->24308 24309 61bbe0-61bbeb call 6fb64f call 6f6658 24308->24309 24310 61bbde 24308->24310 24314 61bbf0-61bbf3 24309->24314 24310->24309 24314->24283
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __fread_nolock
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2638373210-0
                                                                                                                                                                                                  • Opcode ID: df61c93d7978d756c4033fa2ca043d8d2c38003fc87244bd035f4cd285ca4e92
                                                                                                                                                                                                  • Instruction ID: 99bb575bddfa90ca0db920a97bba43dda80d2794fcfd4890f011e2d2b2cac234
                                                                                                                                                                                                  • Opcode Fuzzy Hash: df61c93d7978d756c4033fa2ca043d8d2c38003fc87244bd035f4cd285ca4e92
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71B16A70600248ABDB18DF28CC95FEF77AAEF44700F24095DF5059B6C2D7B49A81CBA4
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006244F0 Relevance: 4.8, APIs: 3, Instructions: 331fileCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 24315 6244f0-62454e 24316 624555-62455a 24315->24316 24316->24316 24317 62455c-62458f call 612830 24316->24317 24320 624590-624595 24317->24320 24320->24320 24321 624597-62460a call 612830 call 61c3e0 call 61c740 24320->24321 24328 624610-624615 24321->24328 24328->24328 24329 624617-624622 24328->24329 24330 624902 call 612040 24329->24330 24331 624628-6246ba call 67d790 call 67d5a0 call 675ad0 24329->24331 24334 624907 call 6f2220 24330->24334 24345 6246e8-624704 24331->24345 24346 6246bc-6246c8 24331->24346 24339 62490c-62490d call 6ebf2b 24334->24339 24343 624912-624917 call 6f2220 24339->24343 24350 624706-624715 24345->24350 24351 624735-62473f 24345->24351 24348 6246ca-6246d8 24346->24348 24349 6246de-6246e5 call 6ecf83 24346->24349 24348->24334 24348->24349 24349->24345 24353 624717-624725 24350->24353 24354 62472b-624732 call 6ecf83 24350->24354 24355 624741-62474d 24351->24355 24356 62476d-624796 CopyFileA 24351->24356 24353->24334 24353->24354 24354->24351 24357 624763-62476a call 6ecf83 24355->24357 24358 62474f-62475d 24355->24358 24359 624798-6247b6 call 61ab50 CopyFileA 24356->24359 24360 6247cf-6247de call 6ec284 24356->24360 24357->24356 24358->24334 24358->24357 24359->24360 24370 6247b8-6247c0 call 6ea800 24359->24370 24360->24339 24371 6247e4-6247f7 call 6ea800 24360->24371 24375 6247c5-6247ca 24370->24375 24374 6247fc-624824 call 675d50 24371->24374 24383 624852-62485f call 6824b0 24374->24383 24384 624826-624850 24374->24384 24377 6248a3-6248a9 24375->24377 24378 6248d3-624901 call 677f40 24377->24378 24379 6248ab-6248b7 24377->24379 24381 6248c9-6248d0 call 6ecf83 24379->24381 24382 6248b9-6248c7 24379->24382 24381->24378 24382->24343 24382->24381 24387 624862-624865 24383->24387 24384->24387 24392 624896-6248a0 call 6ec295 24387->24392 24393 624867-624876 24387->24393 24392->24377 24394 624878-624886 24393->24394 24395 62488c-624893 call 6ecf83 24393->24395 24394->24343 24394->24395 24395->24392
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?), ref: 0062478E
                                                                                                                                                                                                  • CopyFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?), ref: 006247AE
                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 0062489B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CopyFile$Mtx_unlock
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 741997458-0
                                                                                                                                                                                                  • Opcode ID: b544e45201106622f24b9561269de5cf52b0cf42a773af1e983980c90f005b84
                                                                                                                                                                                                  • Instruction ID: 5f4f25dfc751f3c0e9fd85e77434bc6d8a258835160d90eeebf2b83378382b1a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b544e45201106622f24b9561269de5cf52b0cf42a773af1e983980c90f005b84
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1EC13771D006488FDB08DFA8DC55BEEB776FF41304F24829CE4056B292EB74AA85CB91
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00702093 Relevance: 3.3, APIs: 2, Instructions: 297COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 0e5226db2d1af71a2151f9471a119ad611c9fe0032d5053c822bb6e6aef2bb38
                                                                                                                                                                                                  • Instruction ID: 4f19f247da94d1110c1e9a0d0a55100f6443267cfc7fd625e492a8bf6d25f9e9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0e5226db2d1af71a2151f9471a119ad611c9fe0032d5053c822bb6e6aef2bb38
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 40B1E372A04249EFDB11DFA8C885BADBBF2BF4A314F144258E9045B2D3C7789D42CB65
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00624920 Relevance: 3.1, APIs: 2, Instructions: 127COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Mtx_unlock
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1418687624-0
                                                                                                                                                                                                  • Opcode ID: 73fdcdc917f7ca86d0692e113cbf075ea879533b45a418ff63b92bd6ab9def24
                                                                                                                                                                                                  • Instruction ID: 84b019043d42ddc65fa8ce8ef211da9e2b73b95ac866d9a1f3a9df9fd4124f9b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 73fdcdc917f7ca86d0692e113cbf075ea879533b45a418ff63b92bd6ab9def24
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CE313CB2F002108BDB1CDF68EC85A6EB763EB81300B14417DE9029B356DB369D41CBD9
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0061BF40 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AttributesFileMtx_unlock
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1424188087-0
                                                                                                                                                                                                  • Opcode ID: ae49bc252961025099bde68ed7864a49e72014382bdf6842b670cc6021181c05
                                                                                                                                                                                                  • Instruction ID: bcf4f9d824d101fcc2592ae65ad3ce8e64b47080ce350e50d19e94ec6d2a8f4a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae49bc252961025099bde68ed7864a49e72014382bdf6842b670cc6021181c05
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1F0F6A16863801D5D382D756CDA9FE670BC96336872C7625FC05C6342E743CDC349A3
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 007051D9 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,006F6861,?), ref: 007051E1
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 007051F2
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DeleteFile__dosmaperr
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1911827773-0
                                                                                                                                                                                                  • Opcode ID: d8e9b1aac684e3927013009512ad3655e66fa8b9eaf8073a4f5602459965cc5e
                                                                                                                                                                                                  • Instruction ID: 691a68eddf033dbef9f72296f9a2e2b97afb28e66de96adbb2ce82080f3c0864
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8e9b1aac684e3927013009512ad3655e66fa8b9eaf8073a4f5602459965cc5e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 32D0123115560C2A9E1037F57C199AB779D8A922B43201715B92C856D0EE66C8524451
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006F23B2 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 72ef60d71432bf24c9ef52e0b1d2c417d834158fb0de499fd2c53ac7577713d4
                                                                                                                                                                                                  • Instruction ID: 9a67f1cc0fc8a739b7169bae0d6b73cdf2eb616ef877e9ac6423637b008d1e2b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 72ef60d71432bf24c9ef52e0b1d2c417d834158fb0de499fd2c53ac7577713d4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E9519070A00109AFDB14CF58CCA5AB9BBA2AF49324F248159EA099B352D371DE41CF90
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00677F40 Relevance: 1.6, APIs: 1, Instructions: 150COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • std::locale::_Init.LIBCPMT ref: 00678076
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1620887387-0
                                                                                                                                                                                                  • Opcode ID: c4d5967798baed1a60e21f418454b1e15d9a63b2afad79ae92806165db308a4d
                                                                                                                                                                                                  • Instruction ID: 9f44e4ab21d5c89d2b3c1aff08d470123aec71ebb7ba1bef410fc016330dcd3d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c4d5967798baed1a60e21f418454b1e15d9a63b2afad79ae92806165db308a4d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0751AAB1600605AFE714CF19C599B9AFBF2FF88314F148269E4098BB81D7B6E954CBD0
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0067BB80 Relevance: 1.6, APIs: 1, Instructions: 140COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0067BCCA
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: c8e0765ad78988e33804390a1e882de3d76ba1de0cd7f19428d99101a512eee9
                                                                                                                                                                                                  • Instruction ID: 49a1478d55b46714584f699c4406d579e0aa24dde043440158eeb0426a1b7ff8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8e0765ad78988e33804390a1e882de3d76ba1de0cd7f19428d99101a512eee9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E4115729001049BCB06EF28DC817AEB7A7EF44350F1486A9F809EB345DB31DE1187D5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006826D0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00682814
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: d9b54c0f13c7ce791e8b1d0112425a553c958ef408490293f2833163a2a2a4f3
                                                                                                                                                                                                  • Instruction ID: 87c4ad33a32d07b47bd46738aee13e9e9b821d39f02d444abd1999bed22c59c9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9b54c0f13c7ce791e8b1d0112425a553c958ef408490293f2833163a2a2a4f3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D941E6B1A005029FDB18EF7DCD968ADB7A6EB083107148729F825C7385E731EE55C790
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0067BA20 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0067BB71
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: 447499fe9261324121193da5a171a28174810a20fdb7d7e2a0826217200d92bf
                                                                                                                                                                                                  • Instruction ID: 4086c595e6e2583f1781ec1bd4653b49c8f9b1bb69af9ce5347b2e7268c3bdd9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 447499fe9261324121193da5a171a28174810a20fdb7d7e2a0826217200d92bf
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2941F4729002099BCB15EF68DC817AEB7A6EF44350F1442A9F809EB305EB31DE1187E5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00612A50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00612B87
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: 7fb932fb5367026938dc38847a660e334f9ee9ccd0c6cffaff000b8195977f5a
                                                                                                                                                                                                  • Instruction ID: 25fc6f5ccabb93e9cc557a59e4434262ce6a363e8561038837cf8454f6ed97e9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7fb932fb5367026938dc38847a660e334f9ee9ccd0c6cffaff000b8195977f5a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 31410572A001069FC718DE3CCC969EDBBEBEF853507188268E819CB355EA30ED91C760
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00612910 Relevance: 1.6, APIs: 1, Instructions: 123COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00612A42
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: a9120a2326f376ab6210cc03ad179bdf7321453fd4ea6abb2298f1c06db5bff5
                                                                                                                                                                                                  • Instruction ID: ff65cbe4aaf0e5021e471b1cb8d6a3bce44274aa37e9aad49ece3d6b0fe8199a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a9120a2326f376ab6210cc03ad179bdf7321453fd4ea6abb2298f1c06db5bff5
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 72412672A002469BC7199F2DD8916EEBBA3EF84350F1846BDE8149B302D6319DA1C7D1
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00675930 Relevance: 1.6, APIs: 1, Instructions: 119COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00675A53
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: 79c0728e0ad83bb53ffd64438464f2b35c7c7acd055fa3e3ff4083c789760363
                                                                                                                                                                                                  • Instruction ID: 36f87a606b3f5df16a91f3e09c6f9a089248e43e1c445673b6aba81c651c6ca2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 79c0728e0ad83bb53ffd64438464f2b35c7c7acd055fa3e3ff4083c789760363
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49317A726006449BD7189F28D881A6EB3D7EF44330B2483BEE55AC7391EBB1DD458791
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006F6688 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __dosmaperr
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2332233096-0
                                                                                                                                                                                                  • Opcode ID: 43a3ff59aede85f66fbe5c105f10ded0d401519ee2262591cb4a408e0356fdac
                                                                                                                                                                                                  • Instruction ID: 65c71ccfce475ef3b2e4bfd636dd5294be9cdfb9768c1ec4ef57a4ee40cedd71
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 43a3ff59aede85f66fbe5c105f10ded0d401519ee2262591cb4a408e0356fdac
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8321E771600619ABDB307F25CD02ABBB7EBAF90364F104219FA29D7291E771E8019791
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00702582 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindCloseChangeNotification.KERNEL32(00000000,00000000,CF830579,?,00702469,00000000,CF830579,00741148,0000000C,00702525,006F662D,?), ref: 007025D8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ChangeCloseFindNotification
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2591292051-0
                                                                                                                                                                                                  • Opcode ID: 365ce38695bc678419ec389a8854fe1bbfd087bcbe5163b4ad1dae0a9976924f
                                                                                                                                                                                                  • Instruction ID: ac01e2ad72bbef8226f11282fe835043b338c216db57188b7230d2e35b866b09
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 365ce38695bc678419ec389a8854fe1bbfd087bcbe5163b4ad1dae0a9976924f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 30110833704214D6D62523745C5DB7E67C95F83734F39038DE9189B2C3EEAD9883415A
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006FBACC Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetFilePointerEx.KERNEL32(00000000,00000000,00740E00,006EC023,00000002,006EC023,00000000,?,?,?,006FBBD6,00000000,?,006EC023,00000002,00740E00), ref: 006FBB08
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FilePointer
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 973152223-0
                                                                                                                                                                                                  • Opcode ID: 60723bbfc5581d8506dd14172ce484dc090539688c8100028bfa102decfbbcbf
                                                                                                                                                                                                  • Instruction ID: 009abf69bb875684dd0dc4438147473540f68bb93eac9eeb676e9aa59912afe1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 60723bbfc5581d8506dd14172ce484dc090539688c8100028bfa102decfbbcbf
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5801D632610159AFCF098F59CC45CEE3B6AEB86330B244208F9119B291EBB1ED528790
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006ECD02 Relevance: 1.6, APIs: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00611FDE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ___std_exception_copy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2659868963-0
                                                                                                                                                                                                  • Opcode ID: a30e1e36612f4952697ed42888bca20c9c641f3d71e49e419a593c824c97b100
                                                                                                                                                                                                  • Instruction ID: 89bd6d380106efd152e59efa3b4142b80fc26f92bd93af32b7ae1e683a2b5fdf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a30e1e36612f4952697ed42888bca20c9c641f3d71e49e419a593c824c97b100
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 00012B3540034DA7C714AB99EC014DA7BAEDE013607508239F6049B551FB71E591C2D5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00703E63 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000008,006EB16C,?,?,007037E9,00000001,00000364,?,00000006,000000FF,?,006EE0EB,?,?,?,?), ref: 00703EA5
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                  • Opcode ID: 4c6a2c34640de06f9b19353e34ddfd8e62db5d1091cbe9eb64c63564dbbeddf9
                                                                                                                                                                                                  • Instruction ID: 33fe2f11987bb96d4c01d61cc2406351a042255cc7e2894d1b416753123324f4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4c6a2c34640de06f9b19353e34ddfd8e62db5d1091cbe9eb64c63564dbbeddf9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4EF0E232600235E6DB326B72DC05B6B37CEAF41360B158312BC089A0C1DB78FE0083E4
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0067EAD0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 0067EB24
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                  • Opcode ID: df602fa8faa3cba4ac978bdba9ae5c77dfe698587c45f9bbb5c7717de3488d89
                                                                                                                                                                                                  • Instruction ID: 9bf29d3fa050c911e687d90d41ea7ab8a30346516f404932d64b6ce2ab3aee7c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: df602fa8faa3cba4ac978bdba9ae5c77dfe698587c45f9bbb5c7717de3488d89
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 73F0E9B11012080AE618E7A4AA469AE76CF8E6475074481BAE50ECB651E727F959C119
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 0070489D Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000,?,?,?,006EE0EB,?,?,?,?,?,00612D8D,006EB16C,?,?,006EB16C), ref: 007048D0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                  • Opcode ID: 2fd0b75ee48ef06da796daf31138dfa0209759ba78da601828b9db5c3b0dab0e
                                                                                                                                                                                                  • Instruction ID: 9d737eaf68839c4dd57ded4d58d82441fc941c45ea9f0d241bcfd0fce7ee3e56
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2fd0b75ee48ef06da796daf31138dfa0209759ba78da601828b9db5c3b0dab0e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61E09BB51116A5D6EA3137754C05B6B37CADF423B0F168B31AF04A60D1DB6CEC0083E5
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 00704823 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000000,00000000,?,0070C719,?,00000000,?,?,0070C9BA,?,00000007,?,?,0070CEAE,?,?), ref: 0070483A
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FreeHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3298025750-0
                                                                                                                                                                                                  • Opcode ID: 0b1eed91cf8a90b8e794305449292cd59d2ce5667c8e2de08a9ba37e32d3f431
                                                                                                                                                                                                  • Instruction ID: 630eabf5083fdeb6ff91f573d6d80fb3c3fd8d5a1040dbb2346736db5189150f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0b1eed91cf8a90b8e794305449292cd59d2ce5667c8e2de08a9ba37e32d3f431
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BFE0CD711003186BDB1137B45D19BEA379A8B42351F118824FB0C5B5A0DB74995082D8
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006EB687 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(?,?,00000007,00000000,00000003,?,00000000,?,?,006EB5A9,?,?,00000080,?,?,?), ref: 006EB69C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                                                  • Opcode ID: 6a731a3c0281bef6bdad8b7a44c01414bec2b38813021e46429baf8dd5012d1a
                                                                                                                                                                                                  • Instruction ID: f37976330a8b935c8215fa84a1ac76d42a79208018a7da736eb549550275827b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6a731a3c0281bef6bdad8b7a44c01414bec2b38813021e46429baf8dd5012d1a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0E086312412287BDB215EB5EC08EDB7F59DF167B0F104214FA18972D0C2714820D7D0
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006FCB99 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ExitProcess.KERNEL32(?,?,006FCB93,00000016,006F2013,?,?,DFE4C81C,006F2013,?), ref: 006FCBC3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExitProcess
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 621844428-0
                                                                                                                                                                                                  • Opcode ID: 9e91aee4c93e96f506948057d23cb385b7211992e1bdc656c5447d3543649be2
                                                                                                                                                                                                  • Instruction ID: db73932a8e94fa9a051164b55f7d896076556fd73ec10fe5841fa32c2f3a2233
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e91aee4c93e96f506948057d23cb385b7211992e1bdc656c5447d3543649be2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1ED0A73100110C7FCE643B31DD0FCEC3F079F41360F4010A0BE441A122CF31A9918584
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                  Function 006EB374 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindNextFileW.KERNELBASE(?,?,?,0061646F,?,?,?,?,?,?,00730624,00000001), ref: 006EB37D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000000.00000002.2645200426.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645072442.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2645200426.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2655786692.0000000000747000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.000000000075A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009C5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2656900421.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2667764994.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669351042.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  • Associated: 00000000.00000002.2669549514.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_610000_jk98mGM6JH.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileFindNext
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2029273394-0
                                                                                                                                                                                                  • Opcode ID: 83bcb49bce09cc7a065e68da01413c87bede2f3ed594100a1256e3505f557523
                                                                                                                                                                                                  • Instruction ID: 39c23d7a9995c949c4c9e3f41653a981ede142939fdef5d792f212228c42a022
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 83bcb49bce09cc7a065e68da01413c87bede2f3ed594100a1256e3505f557523
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D2C0803514534DB79F1036639C0589F77999B16390710E420684590111EF33C8219161
                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                  Uniqueness Score: -1.00%